A7.9: Do you review administrative access regularly?
Do you review who should have administrative access on a regular basis?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A7.9 only if you review the list of people with administrator access on a regular schedule, monthly, quarterly or annually depending on your business, and remove admin access from anyone who no longer needs it. Record each review with the date and the changes made, and also remove access promptly when someone changes role.
Is A7.9 an automatic fail?
No. A7.9 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must review the list of people with administrator access regularly. Depending on your business, this might be monthly, quarterly or annually.
- Requirement enforced
Your organisation must remove or disable special access privileges when no longer required (when a member of staff changes role, for example).
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.8A7.10Back to the user access control control
What does A7.9 ask?
A7.9 asks: “Do you review who should have administrative access on a regular basis?”
A7.9 asks whether you review who should have administrative access on a regular basis. The guidance says you must review the list regularly, that depending on your business this might be monthly, quarterly or annually, and that anyone who no longer needs administrative access should have it removed.
The requirement behind it: remove or disable special access privileges when no longer required, for example when a member of staff changes role. The review uses the register from A7.8.
What must be true to answer Yes to A7.9?
You can answer Yes to A7.9 only when all of the following are true today, across every device, user and cloud service in scope.
- A review frequency is set: monthly, quarterly or annually.
- The review covers every system in the admin register, including cloud services and MSP accounts.
- Access that is no longer needed is removed and the change recorded.
- Role changes trigger removal straight away, not just at the next review.
Why do applicants fail A7.9?
A common reason applicants fail A7.9: no review since the accounts were created.
- Reviews that only look at Microsoft 365.
- Former MSP or contractor admin accounts left in place.
- No record of the review.
How do you fix a failing A7.9 answer?
If your answer to A7.9 would not pass today, fix the control first and then write the answer. In order:
- Set a review frequency: monthly, quarterly or annually.
- Review the admin register against current roles and remove access nobody needs.
- Record the date and changes, and remove access straight away when someone changes role.
How do assessors check A7.9?
What evidence should you keep for A7.9?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.9:
- The dated record of the last admin access review and any access removed.
Where to go next
- Privileged accessGlossary
- Administrator accountGlossary
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A7 questions
- A7.7A7.7NotesHow does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?Notes
- A7.8A7.8Yes/NoDo you formally track which users have administrator accounts in your organisation?Yes/No
- A7.10A7.10NotesWhere you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?Notes
- A7.11A7.11NotesWhich technical controls are used to manage the quality of your passwords within your organisation?Notes
Frequently asked questions
A7.9 in the 2026 Danzell Cyber Essentials question set asks: "Do you review who should have administrative access on a regular basis?" It is a Yes/No question.
Answer Yes to A7.9 only if you review the list of people with administrator access on a regular schedule, monthly, quarterly or annually depending on your business, and remove admin access from anyone who no longer needs it. Record each review with the date and the changes made, and also remove access promptly when someone changes role.
No. A7.9 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
IASME's A7.9 guidance says regularly, and that depending on your business this might be monthly, quarterly or annually.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh