A7.13: Do you have a process for compromised passwords or accounts?
Do you have a process for when you believe the passwords or accounts have been compromised?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A7.13 only if there is an established process to change passwords promptly when you know or suspect a password or account has been compromised. It should name the triggers, who acts, the steps (reset the password, revoke sessions, check MFA methods and sign-in logs) and how staff report a suspected compromise.
Is A7.13 an automatic fail?
No. A7.13 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must have an established process that details how to change passwords promptly if you believe or suspect a password or account has been compromised.
- Requirement enforced
You should make sure there is an established process in place to change passwords promptly if you know or suspect a password or account has been compromised.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.12A7.14Back to the user access control control
What does A7.13 ask?
A7.13 asks: “Do you have a process for when you believe the passwords or accounts have been compromised?”
A7.13 asks whether you have a process for when you believe passwords or accounts have been compromised. The guidance says you must have an established process that details how to change passwords promptly if you believe or suspect a password or account has been compromised.
The same requirement sits behind A4.4 for firewalls and A5.6 for external services, so one incident procedure can cover all three if it names each.
What must be true to answer Yes to A7.13?
You can answer Yes to A7.13 only when all of the following are true today, across every device, user and cloud service in scope.
- Staff know how to report a suspected compromise, for example a phishing click or an unexpected MFA prompt.
- A named person resets the password, revokes active sessions and removes unknown MFA methods.
- Sign-in logs and mailbox rules are checked for signs of misuse.
- The procedure is written down and covers cloud services, devices, firewalls and external services.
Why do applicants fail A7.13?
A common reason applicants fail A7.13: no written process; it depends on whoever is available.
- Resetting the password but leaving attacker sessions and MFA methods in place.
- No route for staff to report a suspected compromise.
- A process that covers Microsoft 365 but not other cloud services.
How do you fix a failing A7.13 answer?
If your answer to A7.13 would not pass today, fix the control first and then write the answer. In order:
- Write a compromised account procedure with an owner.
- Include how staff report it, resetting the password, revoking sessions, removing unknown MFA methods, and checking sign-in logs and mailbox rules.
- Make it cover cloud services, devices, firewalls (A4.4) and external services (A5.6).
How do assessors check A7.13?
What evidence should you keep for A7.13?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.13:
- The written compromised account procedure, with its owner.
Where to go next
- Credential stuffingGlossary
- PhishingGlossary
- Microsoft 365 and Entra ID setupSetup guide
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.11A7.11NotesWhich technical controls are used to manage the quality of your passwords within your organisation?Notes
- A7.12A7.12NotesPlease explain how you encourage people to use unique and strong passwords.Notes
- A7.14A7.14Yes/NoDo all of your cloud services have multi-factor authentication (MFA) available as part of the service?Yes/No
- A7.15A7.15Conditional auto-failIf you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.Conditional auto-fail
Frequently asked questions
A7.13 in the 2026 Danzell Cyber Essentials question set asks: "Do you have a process for when you believe the passwords or accounts have been compromised?" It is a Yes/No question.
Answer Yes to A7.13 only if there is an established process to change passwords promptly when you know or suspect a password or account has been compromised. It should name the triggers, who acts, the steps (reset the password, revoke sessions, check MFA methods and sign-in logs) and how staff report a suspected compromise.
No. A7.13 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
How staff report it, who acts, resetting the password, revoking sessions, removing unknown MFA methods, checking sign-in logs and mailbox rules, and recording what happened.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh