A5.6: How do you change external service passwords after a compromise?
Describe the process in place for changing passwords on your external services when you believe they have been compromised.
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A5.6 answer describes the process for changing passwords on your external services, such as a VPN or customer portal, promptly when you believe they have been compromised. Name the triggers, who acts and how accounts are reset. It can be the same incident process as A7.13, as long as it covers these services.
Is A5.6 an automatic fail?
No. A5.6 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Passwords may be compromised if there has been a virus on your system or if the manufacturer notifies you of a security weakness in their product. You should know how to change the password if this occurs.
- Logic
- If yes to A, B or C on question A5.4
- Requirement enforced
You should also make sure there is an established process in place to change passwords promptly if you know or suspect a password or account has been compromised.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A5.5A5.7Back to the secure configuration control
What does A5.6 ask?
A5.6 asks: “Describe the process in place for changing passwords on your external services when you believe they have been compromised.”
A5.6 asks you to describe the process for changing passwords on your external services when you believe they have been compromised. The guidance says passwords may be compromised if there has been a virus on your system or if the manufacturer notifies you of a security weakness, and that you should know how to change the password if this happens.
The requirement behind it: make sure there is an established process in place to change passwords promptly if you know or suspect a password or account has been compromised. It applies to the services you declared in A5.4.
What should you write in the notes field for A5.6?
Write two to four specific sentences for A5.6: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
If we know or suspect a password for [VPN / client portal] is compromised (malware on a user's device, a vendor security advisory, a credential found in a breach, or unusual sign-ins), [role] resets the affected password within [one working day / immediately], signs out active sessions, and reviews the sign-in logs. Where the vendor advisory affects the service itself, all administrator passwords are changed after the update is applied. The process is part of our incident procedure (A7.13), owned by [role].
Why do applicants fail A5.6?
A common reason applicants fail A5.6: describing password expiry, which v3.3 says not to enforce, rather than a compromise process.
- No mention of the external service specifically.
- No owner or timescale.
- Not covering administrator accounts on the service.
How do you fix a failing A5.6 answer?
If your answer to A5.6 would not pass today, fix the control first and then write the answer. In order:
- Write a compromise procedure that names each external service.
- Set the triggers, the owner and the timescale for resetting passwords.
- Include signing out active sessions and reviewing sign-in logs, and link it to A7.13.
How do assessors check A5.6?
What evidence should you keep for A5.6?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.6:
- The compromise procedure naming each external service, with its owner.
Where to go next
- Credential stuffingGlossary
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A5 questions
- A5.4A5.4Yes/NoDo you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?Yes/No
- A5.5A5.5Options A to EIf yes to question A5.4, which authentication option do you use?Options A to E
- A5.7A5.7Options A to CWhen not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?Options A to C
- A5.8A5.8Yes/NoHave you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?Yes/No
Frequently asked questions
A5.6 in the 2026 Danzell Cyber Essentials question set asks: "Describe the process in place for changing passwords on your external services when you believe they have been compromised." It is a notes question, answered in free text.
A compliant A5.6 answer describes the process for changing passwords on your external services, such as a VPN or customer portal, promptly when you believe they have been compromised. Name the triggers, who acts and how accounts are reset. It can be the same incident process as A7.13, as long as it covers these services.
No. A5.6 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. v3.3 says not to enforce regular password expiry. Change them when you know or suspect they have been compromised.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh