A7.4: How do you make sure staff only have the access they need?
Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.4 answer explains how you apply least privilege: access is granted by role, changed when someone moves role, and reviewed. Name the mechanism (security groups, role-based permissions in each cloud service), who approves extra access, and how often access is reviewed. IASME's guidance requires the principle of least privilege.
Is A7.4 an automatic fail?
No. A7.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- When a staff member changes job role you may also need to change their permissions to only access the files, folders and applications that they need to do their day-to-day work. For Cyber Essentials we require that the principle of least privilege be applied.
- Requirement enforced
Your organisation must be in control of your user accounts and the access privileges that allow access to your organisational data and services.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.3A7.5Back to the user access control control
What does A7.4 ask?
A7.4 asks: “Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?”
A7.4 asks whether staff only have the access privileges they need to do their current job, and how you do this. The guidance says that when a staff member changes role you may need to change their permissions so they only reach the files, folders and applications they need, and that Cyber Essentials requires the principle of least privilege.
The requirement behind it: your organisation must be in control of user accounts and the access privileges that allow access to your organisational data and services, including third-party accounts. See least privilege.
What should you write in the notes field for A7.4?
Write two to four specific sentences for A7.4: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Access is granted by role through [Entra ID / Google] security groups mapped to SharePoint sites, shared drives and application roles. Line managers request access beyond the role template and [director] approves it. When someone changes role, HR triggers a mover request and [IT lead / MSP] removes the old group memberships the same week. [Role] reviews group membership and access to [finance, HR and client data] every [quarter].
Why do applicants fail A7.4?
A common reason applicants fail A7.4: everyone has access to every shared folder 'for simplicity'.
- Movers keep their old access when they change role.
- Third-party and MSP accounts with broad access nobody reviews.
- No review process at all.
How do you fix a failing A7.4 answer?
If your answer to A7.4 would not pass today, fix the control first and then write the answer. In order:
- Grant access through role-based groups, not to individuals.
- Add a mover step so old access is removed when someone changes role.
- Review access to sensitive data, and third-party and MSP access, on a schedule.
How do assessors check A7.4?
What evidence should you keep for A7.4?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.4:
- The role-to-group mapping and the last access review.
Where to go next
- Least privilegeGlossary
- Privileged accessGlossary
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.2A7.2Yes/NoAre all your user and administrative accounts accessed by entering unique credentials?Yes/No
- A7.3A7.3NotesHow do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?Notes
- A7.5A7.5NotesDo you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?Notes
- A7.6A7.6NotesHow does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?Notes
Frequently asked questions
A7.4 in the 2026 Danzell Cyber Essentials question set asks: "Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?" It is a notes question, answered in free text.
A compliant A7.4 answer explains how you apply least privilege: access is granted by role, changed when someone moves role, and reviewed. Name the mechanism (security groups, role-based permissions in each cloud service), who approves extra access, and how often access is reviewed. IASME's guidance requires the principle of least privilege.
No. A7.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Giving each person only the access they need for their current job, and removing access they no longer need. IASME's A7.4 guidance says Cyber Essentials requires it.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh