Cyber Essentials A7 questions: user access control
The A7 questions test control 4: account creation, unique credentials, leavers, admin separation, password rules and MFA on cloud services. A7.16 and A7.17 fail automatically on a No; A7.15 fails if a listed service does offer MFA.
Section A7 tests user access control, the longest control section. It covers joiners and leavers, unique credentials, least privilege, separate admin accounts, password rules and MFA on every cloud service. A7.16 (administrators) and A7.17 (users) fail automatically on a No, and A7.15 fails automatically if a listed service does offer MFA.
- Questions
- 17 (A7.1 to A7.17)
- Auto-fails
- A7.15 (conditional), A7.16, A7.17
- CE Plus test
- Test 4: MFA on cloud services; Test 5: account separation
What questions are in section A7?
Section A7 has 17 questions, A7.1 to A7.17, of which A7.15 (conditional), A7.16, A7.17 are automatic fails. Each page gives the exact wording, what a compliant answer looks like and a model answer.
- A7.1A7.1NotesAre your users only provided with user accounts after a process has been followed to approve their creation? Describe the process.Notes
- A7.2A7.2Yes/NoAre all your user and administrative accounts accessed by entering unique credentials?Yes/No
- A7.3A7.3NotesHow do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?Notes
- A7.4A7.4NotesDo you ensure that staff only have the access privileges that they need to do their current job? How do you do this?Notes
- A7.5A7.5NotesDo you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?Notes
- A7.6A7.6NotesHow does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?Notes
- A7.7A7.7NotesHow does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?Notes
- A7.8A7.8Yes/NoDo you formally track which users have administrator accounts in your organisation?Yes/No
- A7.9A7.9Yes/NoDo you review who should have administrative access on a regular basis?Yes/No
- A7.10A7.10NotesWhere you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?Notes
- A7.11A7.11NotesWhich technical controls are used to manage the quality of your passwords within your organisation?Notes
- A7.12A7.12NotesPlease explain how you encourage people to use unique and strong passwords.Notes
- A7.13A7.13Yes/NoDo you have a process for when you believe the passwords or accounts have been compromised?Yes/No
- A7.14A7.14Yes/NoDo all of your cloud services have multi-factor authentication (MFA) available as part of the service?Yes/No
- A7.15A7.15Conditional auto-failIf you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.Conditional: if no to A7.14Conditional auto-fail
- A7.16A7.16Auto-failHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?Auto-fail
- A7.17A7.17Auto-failHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?Auto-fail
How do assessors mark section A7?
Assessors read section A7 as a whole and against the scope inventory in A2: every answer must be true across the whole scope and consistent with the rest of the submission.
Related requirements
- User Access Control requirementsThe control hub with every requirement bullet
- All questionsThe eight sections
- Requirements overviewThe five controls
- What changed in 2026Danzell and v3.3
- Cyber Essentials checklistThe evidence to gather for each question
- Check your readinessScore your answers against the auto-fails first
Frequently asked questions
17, from A7.1 to A7.17. 1 of them are conditional and only appear depending on an earlier answer.
Yes: A7.15 (conditional), A7.16, A7.17. Under the 2026 Danzell question set, a No to A7.16 or A7.17 fails the assessment outright, and A7.15 fails automatically if a cloud service listed there does offer MFA.
7 Yes/No, 10 notes and 0 multiple choice questions.
It depends on the control you pick. With MFA the password element must be at least 8 characters. Without MFA you need either a minimum of 12 characters with no maximum, or a minimum of 8 characters with automatic blocking of common passwords using a deny list. For device unlock only, 6 characters.
No. The requirements say you should not enforce regular password expiry and should not enforce password complexity requirements. Passwords are changed when there is a known or suspected compromise, which is what A7.13 asks about.
Both, on every cloud service that offers it. A7.16 covers administrators and A7.17 covers all users, and under the 2026 Danzell question set a No to either is an automatic fail. The only exception is a service listed in A7.15 that genuinely provides no MFA option.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh