A7.6: How do you make sure separate accounts are used for admin tasks?
How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)? This applies to local administrator accounts, network/domain administrator accounts, and cloud service administrator accounts.
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.6 answer explains how administrative tasks, such as installing software or changing configuration, are carried out only with separate admin accounts, never the person's everyday account. Cover local administrator rights on devices, domain or directory admin accounts, and cloud service admin roles. Name the technical control that enforces it.
Is A7.6 an automatic fail?
No. A7.6 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You must use a separate administrator account from the standard user account, when carrying out administrative tasks such as installing software. Using administrator accounts all day long exposes the device to compromise by malware.
- Requirement enforced
- User Access Control: Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.5A7.7Back to the user access control control
What does A7.6 ask?
A7.6 asks: “How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)? This applies to local administrator accounts, network/domain administrator accounts, and cloud service administrator accounts.”
A7.6 asks how your organisation makes sure separate accounts are used for administrative tasks such as installing software or making configuration changes, across local administrator, network or domain administrator and cloud service administrator accounts. The guidance says using administrator accounts all day exposes the device to malware, and that cloud service administration must use separate accounts.
v3.3 explains why with the 'Jody' example: malware opened from an admin session runs with admin privileges, and ransomware can then encrypt far more data. See standard user account, User Account Control and CE Plus test case 5.
What should you write in the notes field for A7.6?
Write two to four specific sentences for A7.6: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
All staff use standard user accounts on their devices; local administrator rights are removed by [Intune account protection policy / Group Policy], and installs require an IT admin credential at the UAC prompt. Device local admin passwords are unique per device and managed by [Windows LAPS]. IT staff and MSP engineers have separate named admin accounts (admin.name@) for Entra ID, Microsoft 365 and other cloud admin roles, with no mailbox or licence, and MFA enforced. Everyday accounts hold no admin roles.
Why do applicants fail A7.6?
A common reason applicants fail A7.6: users who are local administrators on their own laptops.
- The Microsoft 365 global admin role assigned to the managing director's everyday account.
- A single shared admin account rather than separate named accounts.
- No technical control; separation relies on people remembering.
How do you fix a failing A7.6 answer?
If your answer to A7.6 would not pass today, fix the control first and then write the answer. In order:
- Remove local admin rights from everyday accounts through Intune or Group Policy.
- Deploy Windows LAPS for unique local admin passwords.
- Create separate named admin accounts for directory and cloud admin roles, and remove admin roles from everyday accounts.
How do assessors check A7.6?
What evidence should you keep for A7.6?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.6:
- The policy that removes local admin rights, and the list of separate admin accounts.
Where to go next
- CE Plus test 5: account separationHow admin separation is tested
- Standard user accountGlossary
- LAPSGlossary
- Microsoft Intune setupSetup guide
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
Other A7 questions
- A7.4A7.4NotesDo you ensure that staff only have the access privileges that they need to do their current job? How do you do this?Notes
- A7.5A7.5NotesDo you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?Notes
- A7.7A7.7NotesHow does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?Notes
- A7.8A7.8Yes/NoDo you formally track which users have administrator accounts in your organisation?Yes/No
Frequently asked questions
A7.6 in the 2026 Danzell Cyber Essentials question set asks: "How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)? This applies to local administrator accounts, network/domain administrator accounts, and cloud service administrator accounts." It is a notes question, answered in free text.
A compliant A7.6 answer explains how administrative tasks, such as installing software or changing configuration, are carried out only with separate admin accounts, never the person's everyday account. Cover local administrator rights on devices, domain or directory admin accounts, and cloud service admin roles. Name the technical control that enforces it.
No. A7.6 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Not on their everyday account. Administrative tasks must use a separate admin account. On CE Plus, test case 5 checks that a standard user is prompted for an additional login before an admin process runs.
Yes. The A7.6 guidance says cloud service administration must be carried out using separate accounts.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh