A5.9: Do your devices require a locking mechanism such as a PIN or biometric?
When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A5.9 only if every device that a user holds or sits at, including BYOD laptops, tablets and phones, requires a biometric, password or PIN before its software and services can be used. The unlock method must be protected against brute force, and a PIN or password used only to unlock must be at least 6 characters.
Is A5.9 an automatic fail?
No. A5.9 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Device locking mechanisms such as biometric, password or PIN, need to be enabled to prevent unauthorised access to devices accessing organisational data or services.
- Requirement enforced
Ensure appropriate device locking controls for users that are physically present.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A5.8A5.10Back to the secure configuration control
What does A5.9 ask?
A5.9 asks: “When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?”
A5.9 asks whether, when a device requires a user to have it in hand, you set a locking mechanism on your devices to access the software and services installed. The guidance says device locking such as biometric, password or PIN must be enabled to prevent unauthorised access to devices accessing organisational data or services.
The requirement behind it: ensure appropriate device locking controls for users that are physically present. The detail is in the 'device unlocking credentials' part of v3.3, which A5.10 asks about. See device unlocking and the setup guides for iOS and iPadOS and Android.
What must be true to answer Yes to A5.9?
You can answer Yes to A5.9 only when all of the following are true today, across every device, user and cloud service in scope.
- Every laptop and desktop requires a password, PIN or biometric at sign-in and after the screen locks.
- Every phone and tablet, including personal phones with work email, has a passcode or biometric set.
- The unlock method locks or throttles after no more than 10 failed attempts, or uses the vendor default where it cannot be configured.
- It is enforced by MDM or policy, not left to users.
Why do applicants fail A5.9?
A common reason applicants fail A5.9: BYOD phones with no passcode accessing work email.
- Shared desktops that sign in automatically.
- Tablets used in reception or a warehouse with no PIN.
- A 4-digit PIN as the only unlock credential.
How do you fix a failing A5.9 answer?
If your answer to A5.9 would not pass today, fix the control first and then write the answer. In order:
- Enforce a sign-in and screen-lock credential on every laptop and desktop through MDM or Group Policy.
- Require a passcode or biometric on every phone and tablet in scope, including BYOD, through an MDM or app protection policy.
- Remove auto sign-in from shared PCs and add a PIN to reception or warehouse tablets.
How do assessors check A5.9?
What evidence should you keep for A5.9?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.9:
- The device lock and screen lock policies in MDM or Group Policy for each device type.
Where to go next
- Device unlockingGlossary
- iOS and iPadOS setupSetup guide
- Android setupSetup guide
- Microsoft Intune setupSetup guide
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
Other A5 questions
- A5.6A5.6NotesDescribe the process in place for changing passwords on your external services when you believe they have been compromised.Notes
- A5.7A5.7Options A to CWhen not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?Options A to C
- A5.8A5.8Yes/NoHave you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?Yes/No
- A5.10A5.10NotesWhich method do you use to unlock the devices?Notes
Frequently asked questions
A5.9 in the 2026 Danzell Cyber Essentials question set asks: "When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?" It is a Yes/No question.
Answer Yes to A5.9 only if every device that a user holds or sits at, including BYOD laptops, tablets and phones, requires a biometric, password or PIN before its software and services can be used. The unlock method must be protected against brute force, and a PIN or password used only to unlock must be at least 6 characters.
No. A5.9 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes, if they are in scope because they access organisational data or services. The device locking requirement applies to every in-scope device a user is physically present at.
Yes. v3.3 accepts a biometric, password or PIN as the device unlocking credential, protected against brute force.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh