Cyber Essentials user access control, password and MFA requirements (v3.3, 2026)

What process is needed for creating user accounts?

A defined path from request to approval to creation, with a named approver. A7.1 asks you to describe it, and the IASME guidance says accounts must only be provided after they have been approved by a person with a leadership role in the business. A ticket raised by a line manager, approved by a director or department head and actioned by IT from a joiner checklist is enough; 'the director tells us' is not, unless you write down that the director is the approver and how the request is recorded. The joiners, movers and leavers glossary entry shows the full lifecycle.

QuestionsA7.1

Can accounts be shared?

No. Every user and administrator must authenticate with credentials unique to them. Shared reception logins, a single 'admin' account used by the whole IT team and generic kiosk accounts all fail A7.2, whose guidance says no device, application or cloud service can be accessed without unique credentials and accounts must not be shared. See shared accounts. Service accounts used by systems rather than people should be documented and restricted.

QuestionsA7.2

How quickly must leavers' accounts be removed?

The requirement says 'when they're no longer required' and gives two triggers: the user leaving, or a defined period of inactivity. A7.3 asks how you make sure it happens. Describe the leaver process (HR notifies IT, account disabled on the last day) and any inactivity rule you enforce.

QuestionsA7.3

How is access limited to what each role needs?

Access must match the current role, and special privileges must be removed when a role changes. A7.4 asks how you keep privileges to what each person needs, and its guidance states that the principle of least privilege must be applied: when someone moves role, their access to files, folders and applications changes with them. A7.5 asks for the formal process for granting administrator-level access; the guidance suggests approval by an owner, director, trustee or partner of the organisation.

A7.8 and A7.9 ask whether you track who holds admin accounts and review that list regularly. The A7.9 guidance leaves the cadence to you, monthly, quarterly or annually depending on the business, but expects anyone who no longer needs administrative access to lose it at the review. Record the date and outcome of each review.

QuestionsA7.4A7.5A7.8A7.9

Why must admin accounts be separate from everyday accounts?

Because malware runs with the privileges of the account that opened it. The NCSC's example is Jody, whose administrative login turns a phishing email into network-wide ransomware. Administrators need a standard account for email and browsing and a separate account used only for admin tasks. A7.6 asks how you enforce separation, and the question states that this applies to local administrator accounts, network or domain administrator accounts and cloud service administrator accounts alike. A7.7 asks how you stop admin accounts being used for everyday work. Its guidance says software and update downloads should be performed as a standard user and then installed as an administrator, and that you may not need a technical control: good policy, procedure and regular training can achieve it.

On CE Plus, test case 5 checks this directly on every sampled device.

QuestionsA7.6A7.7

Is MFA mandatory for Cyber Essentials?

For cloud services, yes, wherever the service offers it, for every user and every administrator. The password element of an MFA login must be at least 8 characters with no maximum. A7.14 asks whether all your cloud services offer MFA, giving a text message, a one-time access code or a notification from an authentication app as examples; A7.15 lists any that do not; A7.16 confirms MFA on all cloud administrators and A7.17 on all cloud users. A No to A7.16 or A7.17 is an automatic fail under Danzell, and so is listing a service at A7.15 that does offer MFA.

The NCSC recognises four types of additional factor: a managed or enterprise device, an app on a trusted device, a physically separate token, and a known or trusted account. SMS is not the most secure type of MFA but is far better than none; use an alternative where one works for you.

Practical steps: build the list of cloud services from A2.9, record whether each offers MFA, then enforce it centrally through your identity provider where you can. Conditional access or security defaults in Entra ID, and 2-Step Verification enforcement in Google Workspace, cover most small organisations; the Microsoft 365 and Entra ID and Google Workspace setup guides walk through the settings. Services outside single sign-on, such as accounting, payroll or social media, need MFA switched on service by service.

QuestionsA7.14A7.15AUTO-FAILA7.16AUTO-FAILA7.17AUTO-FAIL

How must passwords be protected against brute force?

At least one of: multi-factor authentication; throttling the rate of attempts so that the wait grows with each failure, allowing no more than 10 guesses in 5 minutes; or locking devices after no more than 10 unsuccessful attempts. A7.10 asks which you use, including where passwords are the backup for a passwordless system.

QuestionsA7.10

What are the Cyber Essentials password rules?

One of three technical controls: multi-factor authentication; a minimum password length of at least 12 characters with no maximum length; or a minimum of at least 8 characters with no maximum and automatic blocking of common passwords using a deny list. A7.11 asks which you use.

The scheme also tells you what not to do: do not enforce regular password expiry and do not enforce password complexity requirements. A7.12 asks how you help people choose unique, strong passwords: educating them to avoid pet names, keyboard patterns and reuse, promoting three random words, and providing secure storage such as a password manager. A7.13 asks whether you have a process for suspected compromise.

QuestionsA7.11A7.12A7.13

Does passwordless authentication count?

Yes. v3.3 lists passkeys (including FIDO2 authenticators, which are regarded as MFA because user authentication is performed), biometric authentication, security keys or tokens, push notifications and one-time codes. Option D in A4.3 and A5.5 is now 'passwordless' and needs a notes description. Where a password remains as a backup, it must still meet the brute-force and quality rules.

QuestionsA7.10A7.11