A7.7: How do you stop admin accounts being used for email and web browsing?
How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A7.7 answer explains how administrator accounts are prevented from everyday activities such as web browsing and email. Technical controls are strongest, for example admin accounts with no mailbox and no licence, but IASME's guidance accepts good policy, procedure and regular training. Software should be downloaded as a standard user and installed with admin rights.
Is A7.7 an automatic fail?
No. A7.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- This question relates to the activities carried out when an administrator account is in use. You must ensure that administrator accounts are not used to access websites or download email.
- Requirement enforced
Your organisation must use separate accounts to perform administrative activities only (no emailing, web browsing or other standard user activities that may expose administrative privileges to avoidable risks).
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.6A7.8Back to the user access control control
What does A7.7 ask?
A7.7 asks: “How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?”
A7.7 asks how your organisation prevents administrator accounts from being used for everyday tasks like browsing the web or accessing email. The guidance says admin accounts must not be used to access websites or download email, that downloads should be done as a standard user and then installed as an administrator, and that this need not be a technical control: it can be based on good policy, procedure and regular training.
The requirement behind it: use separate accounts to perform administrative activities only, with no emailing, web browsing or other standard user activities that may expose administrative privileges to avoidable risks.
What should you write in the notes field for A7.7?
Write two to four specific sentences for A7.7: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Admin accounts have no mailbox and no Microsoft 365 apps licence, so they cannot receive email. [Conditional access blocks admin accounts from signing in to anything other than admin portals / Admin accounts are used only on a dedicated admin workstation.] On devices, admin credentials are entered only at UAC prompts, never used to sign in interactively. The IT acceptable use policy forbids browsing or email with admin accounts, and IT staff and MSP engineers confirm it annually.
Why do applicants fail A7.7?
A common reason applicants fail A7.7: admin accounts with a mailbox and full Office licence.
- Signing in to a laptop as a domain admin and then browsing the web.
- No policy, no training and no technical control.
- An MSP's admin accounts with no restrictions.
How do you fix a failing A7.7 answer?
If your answer to A7.7 would not pass today, fix the control first and then write the answer. In order:
- Remove mailboxes and app licences from admin accounts.
- Where your licence allows, restrict admin accounts by conditional access to admin portals.
- Add the rule to the IT policy and have admins and MSP engineers confirm it.
How do assessors check A7.7?
What evidence should you keep for A7.7?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.7:
- A list of admin accounts showing no mailbox or licence, and the policy staff confirm.
Where to go next
- Administrator accountGlossary
- Conditional accessGlossary
- Microsoft 365 and Entra ID setupSetup guide
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.5A7.5NotesDo you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?Notes
- A7.6A7.6NotesHow does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?Notes
- A7.8A7.8Yes/NoDo you formally track which users have administrator accounts in your organisation?Yes/No
- A7.9A7.9Yes/NoDo you review who should have administrative access on a regular basis?Yes/No
Frequently asked questions
A7.7 in the 2026 Danzell Cyber Essentials question set asks: "How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?" It is a notes question, answered in free text.
A compliant A7.7 answer explains how administrator accounts are prevented from everyday activities such as web browsing and email. Technical controls are strongest, for example admin accounts with no mailbox and no licence, but IASME's guidance accepts good policy, procedure and regular training. Software should be downloaded as a standard user and installed with admin rights.
No. A7.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Not necessarily. IASME's A7.7 guidance says it could be based on good policy, procedure and regular training. Removing the mailbox and licence from admin accounts is a simple technical control that helps.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh