A7.11: Which technical controls manage the quality of your passwords?
Which technical controls are used to manage the quality of your passwords within your organisation?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.11 answer names one of three accepted technical controls for each system: MFA; a minimum password length of at least 12 characters with no maximum; or at least 8 characters with no maximum plus a deny list of common passwords. It should also confirm that you do not enforce regular expiry or complexity rules.
Is A7.11 an automatic fail?
No. A7.11 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Acceptable technical controls that you can use to manage the quality of your passwords are outlined in the section about Password-based authentication in the ‘Cyber Essentials Requirements for IT Infrastructure’ document.
- Requirement enforced
- User Access Control: Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.10A7.12Back to the user access control control
What does A7.11 ask?
A7.11 asks: “Which technical controls are used to manage the quality of your passwords within your organisation?”
A7.11 asks which technical controls manage password quality across your organisation. The requirement is that technical controls, not policy alone, enforce one of: MFA; a minimum length of at least 12 characters with no maximum length restriction; or a minimum length of at least 8 characters with no maximum and automatic blocking of common passwords using a deny list.
The requirements also say what not to do: do not enforce regular password expiry and do not enforce password complexity requirements. Mentioning either in the notes as a positive is a sign the policy is out of date.
The question is notes-only. Name the system, the control and where it is enforced.
What should you write in the notes field for A7.11?
Write two to four specific sentences for A7.11: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Microsoft 365 / Entra ID: MFA enforced for all accounts by conditional access; Entra ID password protection blocks common and custom banned passwords, minimum length [12] characters, no maximum, no periodic expiry, no complexity rules. Local device accounts and Active Directory: minimum length [12] characters enforced by [Group Policy / Intune password policy], no expiry. Cloud services outside SSO (see A2.9): MFA enforced on each; where a service only offers a password, minimum [12] characters generated by [password manager]. Network devices: unique admin passwords of at least 12 characters held in [password manager]. Users are supported with [password manager] and three-random-words guidance (A7.12).
Why do applicants fail A7.11?
A common reason applicants fail A7.11: 'We have a password policy' with no length, no deny list and no mention of MFA.
- An 8-character minimum with no MFA and no deny list, which meets none of the three options.
- Stating that passwords expire every 90 days or must include symbols, which the requirements tell you not to enforce.
- A control that exists only in a written policy, not in the directory or MDM.
How do you fix a failing A7.11 answer?
If your answer to A7.11 would not pass today, fix the control first and then write the answer. In order:
- Choose a technical control for each system: MFA, a 12-character minimum, or an 8-character minimum with a deny list.
- Configure it in the directory or MDM, not just in a written policy.
- Remove forced expiry and complexity rules.
- Describe each system and its control in the notes.
How do assessors check A7.11?
What evidence should you keep for A7.11?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.11:
- The password policy and deny list settings in your directory, and the MFA policy.
Where to go next
- Passkeys, FIDO2 and Cyber EssentialsPasswordless under v3.3
- PasswordGlossary
- Microsoft 365 and Entra ID setupSetup guide
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.9A7.9Yes/NoDo you review who should have administrative access on a regular basis?Yes/No
- A7.10A7.10NotesWhere you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?Notes
- A7.12A7.12NotesPlease explain how you encourage people to use unique and strong passwords.Notes
- A7.13A7.13Yes/NoDo you have a process for when you believe the passwords or accounts have been compromised?Yes/No
Frequently asked questions
A7.11 in the 2026 Danzell Cyber Essentials question set asks: "Which technical controls are used to manage the quality of your passwords within your organisation?" It is a notes question, answered in free text.
A compliant A7.11 answer names one of three accepted technical controls for each system: MFA; a minimum password length of at least 12 characters with no maximum; or at least 8 characters with no maximum plus a deny list of common passwords. It should also confirm that you do not enforce regular expiry or complexity rules.
No. A7.11 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
12 characters with no maximum if length is the only control; 8 characters with no maximum where MFA is used or a deny list automatically blocks common passwords. Device unlock PINs used only to unlock have a separate 6-character minimum.
No. The requirements say you should not enforce password complexity requirements and should not enforce regular password expiry. Length, a deny list or MFA replace them.
Not required, but the requirements say to provide usable secure storage for passwords, for example a password manager or a secure locked cabinet, and to teach people to use the generator built into password managers. It is the easiest way to evidence A7.12.
A list of common or compromised passwords that the system automatically rejects when a user sets a password. Entra ID password protection and similar features in other directories implement it. With a deny list the minimum length drops from 12 to 8 characters.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh