A7.12: How do you encourage people to use unique and strong passwords?
Please explain how you encourage people to use unique and strong passwords.
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.12 answer describes how you support people to choose unique, strong passwords: guidance on avoiding common and reused passwords, promoting at least three random words, a password manager or other secure storage with clear instructions, and no forced expiry or complexity rules. Say how the guidance reaches people, such as induction and annual training.
Is A7.12 an automatic fail?
No. A7.12 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You need to support those that have access to your organisational data and services by informing them of how they should pick a strong and unique password. Further information can be found in the Password-based authentication section, under the User Access Control section in the Cyber Essentials Requirements for IT I…
- Requirement enforced
- User Access Control: Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.11A7.13Back to the user access control control
What does A7.12 ask?
A7.12 asks: “Please explain how you encourage people to use unique and strong passwords.”
A7.12 asks you to explain how you encourage people to use unique and strong passwords. The guidance says you need to support those with access to organisational data and services by informing them how to pick a strong and unique password.
v3.3 lists what that support looks like: educate people to avoid common passwords such as a pet's name, keyboard patterns or passwords used elsewhere, which could include teaching them to use a password manager's generator; encourage longer passwords made of multiple words (a minimum of three), such as the NCSC's three random words; provide usable secure storage such as a password manager or a secure locked cabinet, with clear information about how and when to use it; do not enforce regular password expiry; and do not enforce password complexity requirements. See password manager and passphrase.
What should you write in the notes field for A7.12?
Write two to four specific sentences for A7.12: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
All staff receive password guidance at induction and in annual security training, based on the NCSC's three random words advice: use at least three random words, never reuse a work password elsewhere, and avoid names, dates and keyboard patterns. Every member of staff has [1Password / Bitwarden / Keeper] with instructions on using its generator and storing work credentials. We do not enforce password expiry or complexity rules. Entra ID password protection blocks common passwords (A7.11).
Why do applicants fail A7.12?
A common reason applicants fail A7.12: describing a complexity rule (upper case, number, symbol), which v3.3 says not to enforce.
- Forced 90-day expiry presented as good practice.
- No password manager or other secure storage.
- No description of how the guidance reaches staff.
How do you fix a failing A7.12 answer?
If your answer to A7.12 would not pass today, fix the control first and then write the answer. In order:
- Write short password guidance based on the NCSC's three random words.
- Give staff a password manager, or other secure storage, with instructions.
- Deliver the guidance at induction and in annual training.
- Stop enforcing expiry and complexity rules.
How do assessors check A7.12?
What evidence should you keep for A7.12?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.12:
- The password guidance given to staff and the training or induction record.
Where to go next
- Password managerGlossary
- PassphraseGlossary
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.10A7.10NotesWhere you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?Notes
- A7.11A7.11NotesWhich technical controls are used to manage the quality of your passwords within your organisation?Notes
- A7.13A7.13Yes/NoDo you have a process for when you believe the passwords or accounts have been compromised?Yes/No
- A7.14A7.14Yes/NoDo all of your cloud services have multi-factor authentication (MFA) available as part of the service?Yes/No
Frequently asked questions
A7.12 in the 2026 Danzell Cyber Essentials question set asks: "Please explain how you encourage people to use unique and strong passwords." It is a notes question, answered in free text.
A compliant A7.12 answer describes how you support people to choose unique, strong passwords: guidance on avoiding common and reused passwords, promoting at least three random words, a password manager or other secure storage with clear instructions, and no forced expiry or complexity rules. Say how the guidance reaches people, such as induction and annual training.
No. A7.12 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. v3.3 says to support users by not enforcing regular password expiry and not enforcing password complexity requirements.
Not strictly. v3.3 asks for usable secure storage for passwords, for example a password manager or a secure locked cabinet, with clear information on how and when to use it.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh