A7.15: Which cloud services provide no option for MFA?
If you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.
Source: IASME Cyber Essentials Danzell question set v16.3
A7.15 appears if you answered No to A7.14. List only the cloud services that provide no MFA option of any kind. IASME's guidance says it is an automatic fail if a service listed here does have the option for MFA, so check each one first. Services listed here are the only exceptions to the MFA requirement in A7.16 and A7.17.
Is A7.15 an automatic fail?
Yes, conditionally. The A7.15 guidance says it will be an automatic fail if a cloud service listed there does offer MFA, so list only services that provide no MFA option at all. Four other questions (A6.4, A6.5, A7.16 and A7.17) fail automatically on a No answer.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You must provide a list of cloud services that are in use by your organisation that do not provide any option for MFA. Please note that this will be an automatic fail if a cloud service listed here does have the option for MFA.
- Logic
- If no to A7.14
- Requirement enforced
- User Access Control: Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
- Outcome if non-compliant
- Automatic fail if a cloud service listed there does offer MFA
- Related questions
- A7.14A7.16AUTO-FAILBack to the user access control control
What does A7.15 ask?
A7.15 asks: “If you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.”
A7.15 asks you to list the cloud services in use by your organisation that do not provide any option for MFA. The guidance warns that this will be an automatic fail if a cloud service listed here does have the option for MFA, and points to a list of cloud services with their MFA availability.
A paid tier, an authenticator app option, SMS codes, passkeys or single sign-on through an identity provider that enforces MFA all count as MFA being available. Before listing a service, check its security settings and the vendor's documentation. See multi-factor authentication and the answers that fail automatically.
What should you write in the notes field for A7.15?
Write two to four specific sentences for A7.15: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Service name]: used for [purpose], no MFA option available as confirmed in [vendor documentation or support response, date]. Access is protected by [a unique password of at least 12 characters stored in the password manager / access only from managed devices]. We review this list [quarterly] and will enable MFA as soon as the vendor offers it.
Why do applicants fail A7.15?
A common reason applicants fail A7.15: listing a service that offers MFA on a paid plan or through SSO, which is an automatic fail.
- Listing a service because MFA is 'inconvenient' for users.
- Relying on an old vendor statement when MFA has since been added.
- Listing services you no longer use, which should be removed from A2.9 too.
How do you fix a failing A7.15 answer?
If your answer to A7.15 would not pass today, fix the control first and then write the answer. In order:
- For each service you plan to list, check the vendor's current documentation for any MFA option, including paid tiers and SSO.
- Remove any service that does offer MFA from the list and enforce MFA on it.
- Record the date and source of each check.
How do assessors check A7.15?
What evidence should you keep for A7.15?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.15:
- For each listed service, the vendor documentation or support reply confirming no MFA option, dated.
Where to go next
- The answers that fail automaticallyThe five auto-fails
- Multi-factor authenticationGlossary
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.13A7.13Yes/NoDo you have a process for when you believe the passwords or accounts have been compromised?Yes/No
- A7.14A7.14Yes/NoDo all of your cloud services have multi-factor authentication (MFA) available as part of the service?Yes/No
- A7.16A7.16Auto-failHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?Auto-fail
- A7.17A7.17Auto-failHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?Auto-fail
Frequently asked questions
A7.15 in the 2026 Danzell Cyber Essentials question set asks: "If you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA." It is a notes question, answered in free text.
A7.15 appears if you answered No to A7.14. List only the cloud services that provide no MFA option of any kind. IASME's guidance says it is an automatic fail if a service listed here does have the option for MFA, so check each one first. Services listed here are the only exceptions to the MFA requirement in A7.16 and A7.17.
Conditionally. IASME's guidance says it is an automatic fail if a cloud service listed in A7.15 does have the option for MFA.
Few do. Check each service's settings and documentation before listing it, because listing one that offers MFA fails the assessment.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh