A7.3: How do you remove accounts for staff who leave?
How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.3 answer describes how leavers' accounts are disabled or deleted on every system, not just the main directory: the trigger, the timescale, who does it, and how cloud services outside single sign-on are covered. Most organisations disable accounts on the leaving day and delete them after a set period, and v3.3 also suggests removing accounts after defined inactivity.
Is A7.3 an automatic fail?
No. A7.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- When an individual leaves your organisation, you need to stop them accessing any of your systems.
- Requirement enforced
Remove or disable user accounts when no longer required.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.2A7.4Back to the user access control control
What does A7.3 ask?
A7.3 asks: “How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?”
A7.3 asks how you ensure you have deleted or disabled any accounts for staff who are no longer with your organisation. The guidance says that when someone leaves you need to stop them accessing any of your systems.
The requirement behind it: remove or disable user accounts when they are no longer required, for example when a user leaves or after a defined period of account inactivity. Cloud services outside single sign-on are the common gap. See joiners, movers and leavers.
What should you write in the notes field for A7.3?
Write two to four specific sentences for A7.3: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
HR notifies [IT lead / MSP] of every leaver through [HR system / ticket] at least [n] days before the leaving date. On the leaving day [role] disables the Entra ID account, revokes sessions, removes MFA methods and licences, and removes the person from services outside single sign-on ([list from A2.9]) using the leaver checklist. Devices are collected and wiped. Accounts are deleted after [30 / 90] days. [Role] reviews all accounts [monthly] and disables any with no sign-in for [60] days.
Why do applicants fail A7.3?
A common reason applicants fail A7.3: leavers removed from Microsoft 365 but left active in the accounting, CRM or social media tools.
- No trigger from HR, so IT finds out weeks later.
- Former MSP engineers' accounts left active.
- No periodic review to catch the ones that were missed.
How do you fix a failing A7.3 answer?
If your answer to A7.3 would not pass today, fix the control first and then write the answer. In order:
- Agree with HR that every leaver is notified to IT before the leaving date.
- Build a leaver checklist that covers the directory and every service in A2.9.
- Disable on the leaving day, revoke sessions, and remove MFA methods and licences.
- Run a regular review for accounts with no recent sign-in.
How do assessors check A7.3?
What evidence should you keep for A7.3?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.3:
- The leaver checklist and a recent completed example covering every system in A2.9.
Where to go next
- Joiners, movers and leaversGlossary
- Microsoft 365 and Entra ID setupSetup guide
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.1A7.1NotesAre your users only provided with user accounts after a process has been followed to approve their creation? Describe the process.Notes
- A7.2A7.2Yes/NoAre all your user and administrative accounts accessed by entering unique credentials?Yes/No
- A7.4A7.4NotesDo you ensure that staff only have the access privileges that they need to do their current job? How do you do this?Notes
- A7.5A7.5NotesDo you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?Notes
Frequently asked questions
A7.3 in the 2026 Danzell Cyber Essentials question set asks: "How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?" It is a notes question, answered in free text.
A compliant A7.3 answer describes how leavers' accounts are disabled or deleted on every system, not just the main directory: the trigger, the timescale, who does it, and how cloud services outside single sign-on are covered. Most organisations disable accounts on the leaving day and delete them after a set period, and v3.3 also suggests removing accounts after defined inactivity.
No. A7.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
v3.3 says to remove or disable accounts when no longer required. Disabling on the leaving day is the safe standard and what most assessors expect.
Either meets the requirement. Disable immediately, then delete after a defined period once data is handed over.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh