Cyber Essentials secure configuration requirements (v3.3, 2026)
What Cyber Essentials secure configuration requires: removing unused accounts and software, changing defaults, disabling auto-run, device locking and the A5 questions.
Cyber Essentials secure configuration means removing what you do not use and hardening what you keep: unnecessary accounts and software disabled, default passwords changed, auto-run switched off, users authenticated before they reach organisational data, and device locking with a PIN or password of at least 6 characters protected against brute force.
- Aim
- Ensure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfil their role.
- Applies to
- Servers, desktop computers, laptops, tablets, mobile phones, thin clients, IaaS, PaaS, SaaS
- CE Plus test
- Test case 5: Check account separation
- What changed in 2026
- Option D for external service authentication (A5.5) is now 'passwordless' and needs a notes description. Option E ('none of the above') was added and also requires notes. The device unlocking rules (6 characters, 10 guesses in 5 minutes, lock at 10 attempts) are unchanged.
What does Cyber Essentials require for secure configuration?
The Cyber Essentials secure configuration control is the requirement to remove unnecessary accounts, software and default settings from every in-scope device and cloud service, so that each one provides only the services it needs to fulfil its role.
Out-of-the-box configurations are rarely secure. The NCSC lists the usual weak points: an administrative account with a pre-set, publicly known default password or without MFA, pre-enabled but unnecessary user accounts, and pre-installed but unnecessary applications or services.
The control applies to servers, desktop computers, laptops, tablets, mobile phones, thin clients, IaaS, PaaS and SaaS. It is a proactive, repeated activity, not a one-off build step.
Which user accounts must be removed or disabled?
remove and disable unnecessary user accounts (such as guest accounts and administrative accounts that won’t be used)
Guest accounts, built-in administrator accounts you do not use, vendor support accounts and accounts left behind by leavers. Question A5.2 asks whether every laptop, computer, server, tablet, mobile device and cloud service contains only necessary accounts.
The practical test is a periodic review: export the account list from each system and justify each entry. The A5.2 guidance gives the places to look: on Windows, right-click Start and open Computer Management, then Users; on macOS, System Settings, then Users and Groups; on Linux, the contents of /etc/passwd. Check cloud services too, where unused accounts are easy to miss because nobody signs in to them.
QuestionsA5.2
Do default passwords have to be changed on every device?
change any default or guessable account passwords (see password-based authentication)
Yes. A5.3 asks whether the default password has been changed for all user and administrator accounts on all desktop computers, laptops, thin clients, servers, tablets and mobile phones, and whether the replacements follow the password-based authentication requirements. Network equipment is covered separately by A4.2. Replacement passwords must meet the password rules under user access control: MFA, a minimum of 12 characters, or a minimum of 8 characters with a deny list of common passwords.
The A5.3 guidance describes a password that is difficult to guess as unique and not made up of common or predictable words such as 'password' or 'admin', or predictable number sequences such as '12345'.
QuestionsA5.3
What software and services should be removed?
remove or disable unnecessary software (including applications, system utilities and network services)
Anything without a business use: bundled trial software, games, unused browser extensions, legacy remote-access tools and network services such as SMB or FTP that nothing depends on. Less software means fewer updates to track under the 14-day rule.
A5.1 is a notes question. Describe how you build devices (a standard image, MDM or Autopilot profile) and how you check for and remove unnecessary software. The guidance asks you to check cloud services as well and disable features that are not needed day to day. For a quick manual check it points to Apps and Features (right-click Start) on Windows, the Applications folder in Finder on macOS, and the package manager (apt, rpm, yum) on Linux. The Microsoft Intune setup guide shows how to remove bundled apps and report on installed software across a fleet.
QuestionsA5.1
Which auto-run features must be disabled?
disable any auto-run feature which allows file execution without user authorisation (such as when they are downloaded)
Any feature that executes a file without the user choosing to run it: AutoPlay and AutoRun for removable media, browsers set to open downloads automatically, and Office macros that run on open. A5.8 asks for a Yes. Its guidance accepts the setting that prompts the user to choose what happens each time removable media is inserted, so you do not have to remove the choice entirely, only the automatic execution. Enforce the setting centrally rather than leaving it to each user. See the glossary entry for auto-run for the Windows and macOS settings involved.
QuestionsA5.8
Must users authenticate before reaching organisational data?
ensure users are authenticated before allowing them access to organisational data or services
Yes, on every device and every service. The question set focuses on externally facing services: A5.4 asks whether you run or host external services that give access to non-public data across the internet. If so, A5.5 asks which authentication option you use, A5.6 how you change passwords after a compromise, and A5.7 how you protect against brute force when MFA is not in use.
A5.7 offers throttling the rate of attempts or locking accounts after 10 unsuccessful attempts. The requirements document sets the throttling limit at no more than 10 guesses in 5 minutes.
What are the device locking and unlocking rules?
ensure appropriate device locking controls (see ‘device unlocking’, below) for users that are physically present
Where a device needs the user to be physically present, a biometric, password or PIN must be in place before the user gets access. The chosen method must be protected against brute force: throttling so that no more than 10 guesses are allowed in 5 minutes, or locking the device after no more than 10 unsuccessful attempts. Where the vendor does not let you configure this, the vendor's default is acceptable.
Credentials used only to unlock a device need a minimum password or PIN length of at least 6 characters. If the same credential also authenticates the user to services, the full password requirements apply. A5.9 asks whether locking is set; A5.10 asks which unlock method you use. The device unlocking glossary entry sets the rules side by side.
How does Cyber Essentials Plus test secure configuration?
Cyber Essentials Plus tests secure configuration through Test case 5: Check account separation in the Test Specification v3.2. The steps, paraphrased:
- On each sampled device the assessor observes a user, logged in with their standard account, attempting to run an administrative process.
- If the user is prompted for an additional login and the process does not run with the user's own credentials, the device passes.
- The test is repeated on every sampled device. One device where the process runs without a prompt fails the test case.
Account separation sits between secure configuration and user access control. The secure configuration questions (A5.2, A5.3) are also checked indirectly by test case 2, the authenticated scan, which reveals default accounts and unnecessary services.
Who is responsible for secure configuration in cloud services?
For all three cloud models the NCSC expects both your organisation and the cloud provider to implement secure configuration. In Microsoft 365 or Google Workspace that means you own tenant settings, default accounts, unused features and authentication policy even though the provider runs the platform.
| Requirement | IaaS | PaaS | SaaS |
|---|---|---|---|
| Firewalls | Both your organisation and the cloud provider | The cloud provider and sometimes also your organisation | The cloud provider |
| Secure Configuration | Both your organisation and the cloud provider | Both your organisation and the cloud provider | Both your organisation and the cloud provider |
| Security Update Management | Both your organisation and the cloud provider | Both your organisation and the cloud provider | The cloud provider |
| User Access Control | Your organisation | Your organisation | Your organisation |
| Malware Protection | Both your organisation and the cloud provider | The cloud provider and sometimes also your organisation | The cloud provider |
The applicant is always responsible for ensuring all controls are implemented. Where the provider implements one on your behalf, the commitment must be in contractual clauses or documents referenced by contract. See cloud services scope.
Which questions cover secure configuration?
10 Danzell questions cover secure configuration, A5.1 to A5.10. None of them is an automatic fail, but a non-compliant answer is returned by the assessor. Each links to the exact wording and a model answer.
- A5.1A5.1NotesHave you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?Notes
- A5.2A5.2Yes/NoHave you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?Yes/No
- A5.3A5.3Yes/NoHave you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based a…Yes/No
- A5.4A5.4Yes/NoDo you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?Yes/No
- A5.5A5.5Options A to EIf yes to question A5.4, which authentication option do you use?Conditional: if yes to question A5.4Options A to E
- A5.6A5.6NotesDescribe the process in place for changing passwords on your external services when you believe they have been compromised.Conditional: if yes to A, B or C on question A5.4Notes
- A5.7A5.7Options A to CWhen not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?Conditional: if yes to question A5.4Options A to C
- A5.8A5.8Yes/NoHave you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?Yes/No
- A5.9A5.9Yes/NoWhen a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?Yes/No
- A5.10A5.10NotesWhich method do you use to unlock the devices?Conditional: if yes to Question A5.9Notes
How do assessors check secure configuration?
Related requirements
- Previous control: FirewallsTo make sure that only secure and necessary network services can be accessed from the internet.
- Next control: Security Update ManagementEnsure that devices and software are not vulnerable to known security issues for which fixes are available.
- User access control requirementsThe full password and MFA rules
- Secure configuration questions A5.1 to A5.10Model answers for every A5 question
- CE Plus test 5: account separationHow the assessor checks admin separation
- Glossary: passwordless authenticationOption D explained
- Windows 11 setup guideAccounts, auto-run, lock screen and firewall settings
- A5.10: device unlocking methodHow to word the notes answer
- Cyber Essentials checklistEvery requirement as a row with the evidence to gather
- Check your readinessTest your answers against the auto-fail questions first
Frequently asked questions
At least 6 characters where the credential is only used to unlock the device. If the same PIN or password also authenticates the user to organisational services, the full password rules apply: 12 characters, or 8 with MFA, or 8 with a deny list. Biometrics are allowed as the unlock method with a PIN or password as fallback.
The requirements document does not set a specific timeout. It requires a locking mechanism that needs a credential before access and protection against brute force. A5.9 asks whether a locking mechanism is set on devices that require the user in hand. A short automatic lock is good practice and easy to enforce by policy.
Macros that execute when a document opens are a form of automatic file execution without user authorisation, so they should be blocked by default. Microsoft documents that VBA macros in files from the internet are blocked by default in Microsoft 365 Apps on Windows; confirm the policy is applied across your tenant and mention it in A5.8.
Software you run or host that lets staff or customers reach non-public data across the internet: a VPN server, a mail server, an internally hosted application, or a SaaS or PaaS product you provide to customers. Third-party SaaS you merely subscribe to is covered under cloud services and MFA instead.
Option A, throttling the rate of attempts so that no more than 10 guesses are allowed in 5 minutes, or option B, locking accounts after 10 unsuccessful attempts. Option C requires you to describe another control, and the assessor decides whether it is equivalent. MFA on the service removes the need for A5.7 altogether.
Yes. For SaaS the NCSC expects both your organisation and the provider to implement secure configuration. You are responsible for removing unused accounts, changing default credentials, disabling features you do not use and enforcing authentication, even though Microsoft runs the platform.
No. Neither the v3.3 requirements nor the Danzell question set contains an encryption requirement, so BitLocker or FileVault is not assessed. Encryption is still worth enabling for lost or stolen laptops, and a device management policy that enforces it can sit alongside the screen lock and PIN settings that A5.9 and A5.10 do assess.
A standard build or MDM baseline that lists removed software and disabled services (A5.1), an account review showing guest and unused accounts disabled (A5.2), a record of default credentials changed (A5.3), the policy that disables auto-run (A5.8), and the screen lock, minimum PIN length and lockout settings for each device type (A5.9, A5.10).
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- learn.microsoft.comMicrosoft Learn, Macros from the internet are blocked by default in OfficeRead on learn.microsoft.com (opens in a new tab)