A7.8: Do you formally track who has administrator accounts?
Do you formally track which users have administrator accounts in your organisation?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A7.8 only if you keep a record of every person who holds an administrator account, on devices, the directory and every cloud service, including MSP engineers and break-glass accounts. A spreadsheet or register is fine if it is kept current. Exporting the role assignments from each admin console is the easiest way to build and check it.
Is A7.8 an automatic fail?
No. A7.8 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must track all people that have been granted administrator accounts.
- Requirement enforced
Your organisation must have in place a process to create and approve user accounts.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.7A7.9Back to the user access control control
What does A7.8 ask?
A7.8 asks: “Do you formally track which users have administrator accounts in your organisation?”
A7.8 asks whether you formally track which users have administrator accounts. The guidance says you must track all people who have been granted administrator accounts.
The requirement behind it: your organisation must have a process to create and approve user accounts. The register is the output of A7.5 and the input to the review in A7.9.
What must be true to answer Yes to A7.8?
You can answer Yes to A7.8 only when all of the following are true today, across every device, user and cloud service in scope.
- A register lists every admin account: the person, the system, the role, who approved it and when.
- It covers Microsoft 365 or Google Workspace roles, every other cloud service in A2.9, firewalls and local device admin.
- MSP engineers and emergency access accounts are included.
- It is updated when admin access is granted or removed.
Why do applicants fail A7.8?
A common reason applicants fail A7.8: tracking Microsoft 365 admins but not admins of other cloud services.
- Not knowing which MSP engineers have access.
- A register created once for the assessment and never updated.
- Forgetting break-glass accounts.
How do you fix a failing A7.8 answer?
If your answer to A7.8 would not pass today, fix the control first and then write the answer. In order:
- Export role assignments from every admin console: identity provider, each cloud service, firewalls and device management.
- Build a register with person, system, role, approver and date, including MSP and emergency access accounts.
- Update it whenever admin access changes.
How do assessors check A7.8?
What evidence should you keep for A7.8?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.8:
- The admin account register, with the date it was last updated.
Where to go next
- Administrator accountGlossary
- Global administratorGlossary
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.6A7.6NotesHow does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?Notes
- A7.7A7.7NotesHow does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?Notes
- A7.9A7.9Yes/NoDo you review who should have administrative access on a regular basis?Yes/No
- A7.10A7.10NotesWhere you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?Notes
Frequently asked questions
A7.8 in the 2026 Danzell Cyber Essentials question set asks: "Do you formally track which users have administrator accounts in your organisation?" It is a Yes/No question.
Answer Yes to A7.8 only if you keep a record of every person who holds an administrator account, on devices, the directory and every cloud service, including MSP engineers and break-glass accounts. A spreadsheet or register is fine if it is kept current. Exporting the role assignments from each admin console is the easiest way to build and check it.
No. A7.8 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
The person, the system, the role, who approved it and when, and the date it was last reviewed. Include MSP engineers and emergency access accounts.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh