A7.1: How are new user accounts approved before they are created?
Are your users only provided with user accounts after a process has been followed to approve their creation? Describe the process.
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.1 answer describes the process that approves every user account before it is created: who requests it, which person in a leadership role approves it, who creates it, and where the approval is recorded. It should cover device logins, the directory, server accounts and cloud services, and accounts for contractors and third parties as well as staff.
Is A7.1 an automatic fail?
No. A7.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You must ensure that user accounts (such as logins to laptops and accounts on servers) are only provided after they have been approved by a person with a leadership role in the business.
- Requirement enforced
Your organisation must have in place a process to create and approve user accounts.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.7A7.2Back to the user access control control
What does A7.1 ask?
A7.1 asks: “Are your users only provided with user accounts after a process has been followed to approve their creation? Describe the process.”
A7.1 asks whether users are only provided with user accounts after a process has been followed to approve their creation, and asks you to describe the process. The guidance says accounts, such as logins to laptops and accounts on servers, must only be provided after approval by a person with a leadership role in the business.
The requirement behind it: your organisation must have a process to create and approve user accounts. v3.3 adds that this includes third-party accounts, for example those used by your support services. See joiners, movers and leavers.
What should you write in the notes field for A7.1?
Write two to four specific sentences for A7.1: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
New accounts are requested by the line manager through [HR system / IT request form] once a start date is confirmed. [Director / Head of Operations] approves the request. [IT lead / MSP] then creates the Entra ID account, assigns the standard licence and group memberships for the role, and adds access to other cloud services in A2.9 only as listed in the request. The approval and the accounts created are recorded in [ticketing system]. Contractor and supplier accounts follow the same process and have an end date set at creation.
Why do applicants fail A7.1?
A common reason applicants fail A7.1: the MSP creates accounts on request from anyone, with no approval by a leader in the organisation.
- No record of who approved which account.
- Cloud services outside single sign-on, where managers create accounts themselves.
- Contractor accounts created with no end date.
How do you fix a failing A7.1 answer?
If your answer to A7.1 would not pass today, fix the control first and then write the answer. In order:
- Write a joiner procedure: who requests the account, which leader approves it, who creates it and where the approval is recorded.
- Apply it to every system, including cloud services outside single sign-on and accounts for contractors and MSPs.
- Set an end date on contractor and supplier accounts at creation.
How do assessors check A7.1?
What evidence should you keep for A7.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.1:
- The joiner request and approval for a recent new starter.
Where to go next
- Joiners, movers and leaversGlossary
- Microsoft 365 and Entra ID setupSetup guide
- Google Workspace setupSetup guide
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.2A7.2Yes/NoAre all your user and administrative accounts accessed by entering unique credentials?Yes/No
- A7.3A7.3NotesHow do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?Notes
- A7.4A7.4NotesDo you ensure that staff only have the access privileges that they need to do their current job? How do you do this?Notes
- A7.5A7.5NotesDo you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?Notes
Frequently asked questions
A7.1 in the 2026 Danzell Cyber Essentials question set asks: "Are your users only provided with user accounts after a process has been followed to approve their creation? Describe the process." It is a notes question, answered in free text.
A compliant A7.1 answer describes the process that approves every user account before it is created: who requests it, which person in a leadership role approves it, who creates it, and where the approval is recorded. It should cover device logins, the directory, server accounts and cloud services, and accounts for contractors and third parties as well as staff.
No. A7.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
A person with a leadership role in the business, according to IASME's A7.1 guidance. An IT provider can create the account but should not be the only approver.
Yes. The process should cover every account your organisation owns, including cloud services and accounts used by third parties such as your MSP.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh