A7.2: Are all accounts accessed with unique credentials?
Are all your user and administrative accounts accessed by entering unique credentials?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A7.2 only if every user and administrator account on every device, application and cloud service requires credentials unique to one person. No accounts may be shared. Shared mailboxes are fine when people reach them through their own accounts, but a shared login used by several people, including a shared admin account, makes the answer untrue.
Is A7.2 an automatic fail?
No. A7.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must ensure that no devices, applications or cloud services can be accessed without entering unique access credentials. Accounts must not be shared.
- Requirement enforced
Authenticate users with unique credentials before granting access to applications or devices.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.1A7.3Back to the user access control control
What does A7.2 ask?
A7.2 asks: “Are all your user and administrative accounts accessed by entering unique credentials?”
A7.2 asks whether all your user and administrative accounts are accessed by entering unique credentials. The guidance says no devices, applications or cloud services can be accessed without entering unique access credentials, and that accounts must not be shared.
The requirement behind it: authenticate users with unique credentials before granting access to applications or devices. Unique credentials are also what make MFA, leaver removal and admin tracking work. See shared account.
What must be true to answer Yes to A7.2?
You can answer Yes to A7.2 only when all of the following are true today, across every device, user and cloud service in scope.
- Every person signs in with their own account on devices and cloud services.
- There are no shared logins such as 'reception@', 'office' or a single admin account used by the whole IT team.
- Shared mailboxes and calendars are accessed through delegated permissions, not a shared password.
- Kiosk or shop-floor devices either use per-person logins or are locked to a function with no access to organisational data.
Why do applicants fail A7.2?
A common reason applicants fail A7.2: a shared login for a cloud service with a per-seat licence, to save money.
- One administrator account used by several MSP engineers.
- A shared PC in reception signed in as a generic user with email open.
- Social media accounts accessed with one shared password.
How do you fix a failing A7.2 answer?
If your answer to A7.2 would not pass today, fix the control first and then write the answer. In order:
- Find shared logins on devices, cloud services and social media.
- Replace each with named accounts, using delegated access for shared mailboxes and team features for social media.
- Give every MSP engineer their own admin account.
How do assessors check A7.2?
What evidence should you keep for A7.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.2:
- A user list from each main service showing named accounts only, and how shared mailboxes are delegated.
Where to go next
- Shared accountGlossary
- User accountGlossary
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.1A7.1NotesAre your users only provided with user accounts after a process has been followed to approve their creation? Describe the process.Notes
- A7.3A7.3NotesHow do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?Notes
- A7.4A7.4NotesDo you ensure that staff only have the access privileges that they need to do their current job? How do you do this?Notes
- A7.5A7.5NotesDo you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?Notes
Frequently asked questions
A7.2 in the 2026 Danzell Cyber Essentials question set asks: "Are all your user and administrative accounts accessed by entering unique credentials?" It is a Yes/No question.
Answer Yes to A7.2 only if every user and administrator account on every device, application and cloud service requires credentials unique to one person. No accounts may be shared. Shared mailboxes are fine when people reach them through their own accounts, but a shared login used by several people, including a shared admin account, makes the answer untrue.
No. A7.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes, if each person reaches the shared mailbox through their own account. A shared mailbox that people sign in to directly with one password breaks A7.2.
Use the platform's team or business access features so each person has their own login with MFA. A single shared password does not meet A7.2.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh