A7.14: Do all your cloud services offer MFA?
Do all of your cloud services have multi-factor authentication (MFA) available as part of the service? A cloud service is an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet. For the purposes of Cyber Essentials, a cloud service will be accessed via an account (which may be credentials issued by your organisation or an email address used for business purposes) and will store or process data for your organisation.
Source: IASME Cyber Essentials Danzell question set v16.3
A7.14 records whether every cloud service you listed in A2.9 has multi-factor authentication available as part of the service. Most do, including Microsoft 365, Google Workspace and the major social media platforms. Answer Yes if they all offer it. Answer No only if at least one service provides no MFA option at all, and list those services in A7.15.
Is A7.14 an automatic fail?
No. A7.14 has no fail wording; it records whether every cloud service offers MFA. The automatic fail sits in A7.15: listing a service there that does offer MFA fails the assessment, and A7.16 and A7.17 fail on a No.
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Where your systems and cloud services support multi-factor authentication (MFA)- for example, a text message, a one-time access code, or a notification from an authentication app- you must enable it for all users and administrators.
- Requirement enforced
- User Access Control: Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
- Outcome if non-compliant
- Not marked against a requirement; inaccurate details may be returned for correction
- Related questions
- A7.13A7.15AUTO-FAILBack to the user access control control
What does A7.14 ask?
A7.14 asks: “Do all of your cloud services have multi-factor authentication (MFA) available as part of the service? A cloud service is an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet. For the purposes of Cyber Essentials, a cloud service will be accessed via an account (which may be credentials issued by your organisation or an email address used for business purposes) and will store or process data for your organisation.”
A7.14 asks whether all of your cloud services have MFA available as part of the service, and defines a cloud service as an on-demand, scalable service, hosted on shared infrastructure, accessible via the internet, accessed via an account (organisation-issued credentials or an email address used for business purposes) and storing or processing data for your organisation. That definition is new in v3.3.
The guidance says that where your systems and cloud services support MFA, for example a text message, a one-time access code or an authenticator app notification, you must enable it for all users and administrators. The answer controls the next three questions: a No leads to A7.15, and A7.16 and A7.17 exclude only the services listed there.
How should you answer A7.14?
A7.14 has no single compliant answer. Answer it accurately for your organisation today; this is what each answer means.
- Answer Yes if every service in A2.9 offers some form of MFA, even if only on a paid tier or through single sign-on.
- Answer No only if at least one service offers no MFA option at all, then list it in A7.15.
- Check each service's security settings or vendor documentation before answering; most business services now offer MFA.
- A Yes here means A7.16 and A7.17 apply to every service in A2.9.
What mistakes do applicants make with A7.14?
A common mistake with A7.14: answering No for a service that does offer MFA, which then fails A7.15 automatically when it is listed.
- Not checking services outside single sign-on.
- Treating 'MFA through our identity provider' as unavailable because the service's own login lacks it.
- Forgetting social media accounts, which are cloud services under A2.9.
How do you get A7.14 right?
Work through these steps before you enter A7.14 in the portal:
- Check each service in A2.9 for an MFA option in its security settings or documentation, including paid tiers and single sign-on.
- Answer Yes if every service offers MFA.
- List only services with no MFA option at all in A7.15.
How do assessors check A7.14?
What evidence should you keep for A7.14?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.14:
- For each service in A2.9, a note of the MFA option it offers and where you checked.
Where to go next
- Multi-factor authenticationGlossary
- Cloud services in scopeScope rules
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.12A7.12NotesPlease explain how you encourage people to use unique and strong passwords.Notes
- A7.13A7.13Yes/NoDo you have a process for when you believe the passwords or accounts have been compromised?Yes/No
- A7.15A7.15Conditional auto-failIf you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.Conditional auto-fail
- A7.16A7.16Auto-failHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?Auto-fail
Frequently asked questions
A7.14 in the 2026 Danzell Cyber Essentials question set asks: "Do all of your cloud services have multi-factor authentication (MFA) available as part of the service? A cloud service is an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet. For the purposes of Cyber Essentials, a cloud service will be accessed via an account (which may be credentials issued by your organisation or an email address used for business purposes) and will store or process data for your organisation." It is a Yes/No question.
A7.14 records whether every cloud service you listed in A2.9 has multi-factor authentication available as part of the service. Most do, including Microsoft 365, Google Workspace and the major social media platforms. Answer Yes if they all offer it. Answer No only if at least one service provides no MFA option at all, and list those services in A7.15.
MFA is still available as part of the service. Either move to that plan, replace the service, or accept that A7.16 and A7.17 cannot be answered Yes.
No. A7.14 itself has no fail wording. The automatic fail is in A7.15, if a service you list as having no MFA does offer it.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh