A7.10: How are your passwords protected from brute-force attacks?
Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.10 answer names at least one of the three accepted controls for every system that uses a password: multi-factor authentication, throttling so that no more than 10 guesses are allowed in 5 minutes, or locking the account or device after no more than 10 unsuccessful attempts. Say which control applies to which system, including passwordless fallbacks.
Is A7.10 an automatic fail?
No. A7.10 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works. Information on how to protect against brute-force password guessing can be found in the Password-based authenticatio…
- Requirement enforced
- User Access Control: Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.9A7.11Back to the user access control control
What does A7.10 ask?
A7.10 asks: “Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?”
A7.10 asks how systems that require passwords, or that use passwords as a backup for a passwordless system, are protected from brute-force attacks. A brute-force attack, in the guidance's words, is an attempt to discover a password by systematically trying every possible combination until the correct one works.
The requirement lists the accepted protections: multi-factor authentication; throttling the rate of attempts so that the wait between attempts increases with each failure, allowing no more than 10 guesses in 5 minutes; or locking devices after no more than 10 unsuccessful attempts.
The question is notes-only, so the assessor needs to see which control protects which class of system: cloud identity, device logins, VPN, on-premises directory, network devices.
What should you write in the notes field for A7.10?
Write two to four specific sentences for A7.10: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Cloud services (Microsoft 365 and the services in A2.9): MFA enforced for all users and administrators through [Entra ID conditional access]; Entra smart lockout also locks accounts after 10 failed attempts. Device logins: Windows laptops lock after 10 failed attempts by [Intune / Group Policy account lockout policy]; macOS and mobile devices wipe or lock after 10 failed passcode attempts by [MDM policy]. VPN and on-premises Active Directory: lockout after [10] failed attempts for [30] minutes. Firewalls: admin login throttled by [vendor default, n attempts]. Where passkeys are used, the password fallback is subject to the same lockout.
Why do applicants fail A7.10?
A common reason applicants fail A7.10: a single sentence such as 'we use strong passwords', which does not describe brute-force protection at all.
- A lockout threshold above 10 attempts, or throttling that allows more than 10 guesses in 5 minutes.
- Covering Microsoft 365 but forgetting local device logins, the VPN and network device admin pages.
- Relying on MFA for cloud while the on-premises directory has no lockout policy.
How do you fix a failing A7.10 answer?
If your answer to A7.10 would not pass today, fix the control first and then write the answer. In order:
- List every system that uses a password: cloud identity, device logins, VPN, on-premises directory and network devices.
- For each, enforce MFA, or lockout at 10 failed attempts or fewer, or throttling of no more than 10 guesses in 5 minutes.
- Write the notes system by system with the numbers.
How do assessors check A7.10?
What evidence should you keep for A7.10?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.10:
- The account lockout and smart lockout settings, and device lockout policies.
Where to go next
- Brute-force attackGlossary
- Account lockoutGlossary
- ThrottlingGlossary
- Microsoft 365 and Entra ID setupSetup guide
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
Other A7 questions
- A7.8A7.8Yes/NoDo you formally track which users have administrator accounts in your organisation?Yes/No
- A7.9A7.9Yes/NoDo you review who should have administrative access on a regular basis?Yes/No
- A7.11A7.11NotesWhich technical controls are used to manage the quality of your passwords within your organisation?Notes
- A7.12A7.12NotesPlease explain how you encourage people to use unique and strong passwords.Notes
Frequently asked questions
A7.10 in the 2026 Danzell Cyber Essentials question set asks: "Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?" It is a notes question, answered in free text.
A compliant A7.10 answer names at least one of the three accepted controls for every system that uses a password: multi-factor authentication, throttling so that no more than 10 guesses are allowed in 5 minutes, or locking the account or device after no more than 10 unsuccessful attempts. Say which control applies to which system, including passwordless fallbacks.
No. A7.10 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Throttling should allow no more than 10 guesses in 5 minutes, or devices and accounts should lock after no more than 10 unsuccessful attempts. Either satisfies the requirement; MFA is the third option.
For the systems it covers, yes. MFA is the first listed brute-force protection. You still need throttling or lockout for systems where a password is used without MFA, such as local device logins or an on-premises directory.
Yes, and A5.10 asks about that separately. The device locking rules use the same thresholds: no more than 10 guesses in 5 minutes or lockout after no more than 10 attempts, or the vendor default where it cannot be configured.
The requirements say that when the vendor does not allow you to configure throttling or lockout, use the vendor's default setting. State that in the notes and name the product.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh