A7.5: What is your process for granting administrator access?
Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.5 answer describes a formal process for granting administrator-level access: who requests it, who approves it (typically an owner, director, trustee or partner), how the separate admin account is created, and where it is recorded. It should cover local device admin, domain admin and cloud service admin roles, including MSP engineers.
Is A7.5 an automatic fail?
No. A7.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You must have a process that you follow when deciding to give someone access to systems at administrator level. This process might include approval by a person who is an owner/director/trustee/partner of the organisation.
- Requirement enforced
Your organisation must have in place a process to create and approve user accounts.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.4A7.6Back to the user access control control
What does A7.5 ask?
A7.5 asks: “Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?”
A7.5 asks whether you have a formal process for giving someone administrator-level access, and to describe it. The guidance says the process might include approval by an owner, director, trustee or partner of the organisation.
The requirement behind it: your organisation must have a process to create and approve user accounts, which for privileged accounts means a stricter approval. The record you create here is what A7.8 tracks and A7.9 reviews. See administrator account and privileged access.
What should you write in the notes field for A7.5?
Write two to four specific sentences for A7.5: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Administrator access is requested by [IT lead] with the business reason and the systems needed. [Managing director] approves each request in writing. A separate admin account (for example admin.jsmith) is created with only the roles needed, MFA enforced, and recorded in the admin register held in [location]. MSP engineers receive named admin accounts under the same process. Access is removed when the role no longer needs it (A7.9).
Why do applicants fail A7.5?
A common reason applicants fail A7.5: admin rights granted by the MSP without approval from the organisation.
- Admin roles added to people's everyday accounts rather than separate accounts.
- No record of who has admin access to which system.
- Local admin rights given to all users so they can install software.
How do you fix a failing A7.5 answer?
If your answer to A7.5 would not pass today, fix the control first and then write the answer. In order:
- Write the admin access process: request, approval by an owner or director, a separate admin account, and an entry in the admin register.
- Apply it to MSP engineers and to every cloud service.
- Record approvals for existing admins retrospectively.
How do assessors check A7.5?
What evidence should you keep for A7.5?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.5:
- A recent approval for granting admin access, and the admin register entry it created.
Where to go next
- Administrator accountGlossary
- Privileged accessGlossary
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.3A7.3NotesHow do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?Notes
- A7.4A7.4NotesDo you ensure that staff only have the access privileges that they need to do their current job? How do you do this?Notes
- A7.6A7.6NotesHow does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?Notes
- A7.7A7.7NotesHow does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?Notes
Frequently asked questions
A7.5 in the 2026 Danzell Cyber Essentials question set asks: "Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?" It is a notes question, answered in free text.
A compliant A7.5 answer describes a formal process for granting administrator-level access: who requests it, who approves it (typically an owner, director, trustee or partner), how the separate admin account is created, and where it is recorded. It should cover local device admin, domain admin and cloud service admin roles, including MSP engineers.
No. A7.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
IASME's A7.5 guidance suggests an owner, director, trustee or partner of the organisation. Record the approval.
Yes. v3.3 says all accounts your organisation owns are in scope even when used by a third party such as an MSP.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh