A5.7: How do you protect external services from brute-force attacks?
When not using multi-factor authentication, which option are you using to protect your external service from brute force attacks? A. Throttling the rate of attempts B. Locking accounts after 10 unsuccessful attempts C. None of the above, please describe
Source: IASME Cyber Essentials Danzell question set v16.3
Where an external service login does not use MFA, A5.7 asks which protection stops brute-force guessing. Option A, throttling, and option B, locking accounts after 10 unsuccessful attempts, both pass. Throttling must allow no more than 10 guesses in 5 minutes. Option C, none of the above, needs a description and does not meet the requirement.
Is A5.7 an automatic fail?
No. A5.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Options A to C a multiple choice question with options A to C
- IASME guidance
- The external service that you provide must be set to slow down or stop attempts to log in if the wrong username and password have been tried a number of times. This reduces the opportunity for cyber criminals to keep trying different passwords (brute-forcing) in the hope of gaining access.
- Logic
- If yes to question A5.4
- Requirement enforced
You must protect your chosen authentication method (which can be biometric authentication, password or PIN) against brute-force attacks. When it's possible to configure, you should apply one of the following:
- ‘throttling' the rate of attempts, so that the length of time the user must wait between attempts increases with each unsuccessful attempt - you shouldn’t allow more than 10 guesses in 5 minutes
- locking devices after more than 10 unsuccessful attempts
When the vendor doesn't allow you to configure the above, use the vendor’s default setting.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A5.6A5.8Back to the secure configuration control
What does A5.7 ask?
A5.7 asks: “When not using multi-factor authentication, which option are you using to protect your external service from brute force attacks? A. Throttling the rate of attempts B. Locking accounts after 10 unsuccessful attempts C. None of the above, please describe”
A5.7 asks, when not using multi-factor authentication, which option you are using to protect your external service from brute-force attacks: A, throttling the rate of attempts; B, locking accounts after 10 unsuccessful attempts; or C, none of the above, with a description. The guidance says the service must be set to slow down or stop attempts to log in after a number of wrong guesses.
The requirement: throttle so the wait between attempts increases with each failure and you allow no more than 10 guesses in 5 minutes, or lock after no more than 10 unsuccessful attempts. Where the vendor does not allow either to be configured, use the vendor's default setting. MFA is itself an accepted brute-force protection, which is why the question applies only to logins without it. See throttling and account lockout.
Which option should you choose for A5.7?
Choose the option for A5.7 that is enforced today across the whole scope, and complete the notes wherever the option requires them.
Option A: the service increases the delay after each failed attempt and allows no more than 10 guesses in 5 minutes. Option B: accounts lock after no more than 10 failed attempts. Option C: only if neither is in place; describe the situation, and expect the requirement to be treated as not met unless the vendor offers no configuration and its default applies. If every login uses MFA, say so.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[For option C or clarity] The [VPN / portal] does not use MFA for [account type]. Accounts lock for [30] minutes after [10] failed attempts, configured under [setting]. [Or: the vendor does not allow lockout to be configured; the default behaviour is (describe), which applies.]
Why do applicants fail A5.7?
A common reason applicants fail A5.7: a lockout threshold higher than 10 attempts.
- Throttling that allows more than 10 guesses in 5 minutes.
- Choosing option C for a VPN that could simply be given MFA.
- Answering for the identity provider while the external service uses its own local accounts.
How do you fix a failing A5.7 answer?
If your answer to A5.7 would not pass today, fix the control first and then write the answer. In order:
- For logins without MFA, set account lockout at 10 failed attempts or fewer, or throttling of no more than 10 guesses in 5 minutes.
- Where neither can be configured, name the product and state that the vendor default applies.
- Better still, add MFA so the question no longer applies to that login.
How do assessors check A5.7?
What evidence should you keep for A5.7?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.7:
- The lockout or throttling settings for each external service, or its MFA configuration.
Where to go next
- ThrottlingGlossary
- Account lockoutGlossary
- Brute-force attackGlossary
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A5 questions
- A5.5A5.5Options A to EIf yes to question A5.4, which authentication option do you use?Options A to E
- A5.6A5.6NotesDescribe the process in place for changing passwords on your external services when you believe they have been compromised.Notes
- A5.8A5.8Yes/NoHave you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?Yes/No
- A5.9A5.9Yes/NoWhen a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?Yes/No
Frequently asked questions
A5.7 in the 2026 Danzell Cyber Essentials question set asks: "When not using multi-factor authentication, which option are you using to protect your external service from brute force attacks? A. Throttling the rate of attempts B. Locking accounts after 10 unsuccessful attempts C. None of the above, please describe" It is a multiple choice question with options A to C.
Where an external service login does not use MFA, A5.7 asks which protection stops brute-force guessing. Option A, throttling, and option B, locking accounts after 10 unsuccessful attempts, both pass. Throttling must allow no more than 10 guesses in 5 minutes. Option C, none of the above, needs a description and does not meet the requirement.
No. A5.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No more than 10. Lock after no more than 10 unsuccessful attempts, or throttle so that no more than 10 guesses are possible in 5 minutes.
Yes. MFA is the first listed protection in the password-based authentication section of v3.3. A5.7 only asks about logins that do not use MFA.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh