A5.8: Have you disabled auto-run for downloaded and imported files?
Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A5.8 if no device will automatically run files from removable media, downloads or imports without the user authorising it. Disabling AutoRun and AutoPlay meets the requirement, and so does a setting that prompts the user to choose what happens each time a memory stick is inserted. Enforce it by policy so users cannot change it back.
Is A5.8 an automatic fail?
No. A5.8 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- This is a setting on your device which automatically runs software on external media or downloaded from the internet. It is acceptable to choose the option where a user is prompted to make a choice about what action will occur each time they insert a memory stick.
- Requirement enforced
Disable any auto-run feature which allows file execution without user authorisation (such as when they are downloaded).
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A5.7A5.9Back to the secure configuration control
What does A5.8 ask?
A5.8 asks: “Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?”
A5.8 asks whether you have disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation. The guidance explains that this is a setting that automatically runs software on external media or downloaded from the internet, and that it is acceptable to choose the option where the user is prompted to decide what happens each time they insert a memory stick.
The requirement behind it: disable any auto-run feature which allows file execution without user authorisation, such as when files are downloaded. On Windows that is the AutoPlay and AutoRun policy; macOS and mobile operating systems do not auto-run executables from media. See auto-run and the Windows 11 setup guide.
What must be true to answer Yes to A5.8?
You can answer Yes to A5.8 only when all of the following are true today, across every device, user and cloud service in scope.
- AutoRun is disabled for all drives on Windows devices, through Intune or Group Policy.
- AutoPlay either is off or prompts the user to choose an action, never runs software automatically.
- Browsers are not set to open downloaded executables automatically.
- BYOD Windows laptops in scope are covered, or the setting is confirmed on each.
Why do applicants fail A5.8?
A common reason applicants fail A5.8: autoPlay left at a default that runs software from media without asking.
- Relying on users' individual settings rather than a policy.
- Forgetting servers with a user-interactive desktop.
- Browser settings that open certain file types automatically after download.
How do you fix a failing A5.8 answer?
If your answer to A5.8 would not pass today, fix the control first and then write the answer. In order:
- Deploy an AutoPlay policy through Intune or Group Policy that turns off AutoRun for all drives.
- Set AutoPlay to off, or to prompt the user each time media is inserted.
- Check browsers are not set to open downloaded files automatically.
How do assessors check A5.8?
What evidence should you keep for A5.8?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.8:
- The AutoPlay and AutoRun policy setting in Intune or Group Policy.
Where to go next
- Auto-runGlossary
- Windows 11 setupSetup guide
- Microsoft Intune setupSetup guide
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A5 questions
- A5.6A5.6NotesDescribe the process in place for changing passwords on your external services when you believe they have been compromised.Notes
- A5.7A5.7Options A to CWhen not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?Options A to C
- A5.9A5.9Yes/NoWhen a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?Yes/No
- A5.10A5.10NotesWhich method do you use to unlock the devices?Notes
Frequently asked questions
A5.8 in the 2026 Danzell Cyber Essentials question set asks: "Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?" It is a Yes/No question.
Answer Yes to A5.8 if no device will automatically run files from removable media, downloads or imports without the user authorising it. Disabling AutoRun and AutoPlay meets the requirement, and so does a setting that prompts the user to choose what happens each time a memory stick is inserted. Enforce it by policy so users cannot change it back.
No. A5.8 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. IASME's A5.8 guidance says it is acceptable for the user to be prompted to choose what happens each time they insert a memory stick.
macOS does not auto-run executables from removable media, but check browser settings such as opening 'safe' files after download, and include Macs in your answer.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh