In short: Cyber Essentials user access control requires a process to create and approve accounts, unique credentials for every user, prompt removal of leavers and inactive accounts, MFA where available (always for cloud services), separate admin accounts used only for admin work, and removal of privileges when no longer needed. Third-party and MSP accounts are included.
Why access control matters
Malware usually runs with the rights of whoever opened it. If that person is browsing and reading email while signed in as an administrator, ransomware inherits those rights and can reach far more of your data and systems than it otherwise could. The same logic applies to stolen passwords: the more access an account has, the more damage a criminal can do with it.
User Access Control applies to servers, desktops, laptops, tablets, phones and cloud services. In the cloud shared-responsibility table it is the one control that is always your organisation's job, whatever type of cloud service you use.
The user access control requirements
Your organisation must stay in control of user accounts and the privileges that open your data and services, including accounts used by your support providers. In practice you must:
- Have a process for creating and approving user accounts
- Authenticate every user with unique credentials before giving access to applications or devices
- Remove or disable accounts when they are no longer needed, for example when someone leaves or after a defined period of inactivity
- Use MFA wherever it is available, and always for authentication to cloud services
- Give administrators separate accounts that are used only for admin tasks, never for email, web browsing or other everyday work
- Remove or disable special privileges when they are no longer needed, such as when someone changes role
You also need to understand how each of your accounts authenticates, so you can apply the right rules to it.
Joiners, movers and leavers
Most access-control failures are process failures. A short, written routine fixes most of them:
- Joiners: a named person approves each new account and the access it gets, and the request is recorded
- Movers: when someone changes role, their old access is removed rather than added to
- Leavers: accounts are disabled on the last day, with shared credentials they knew changed promptly
- Inactivity: a defined period after which unused accounts are disabled, checked on a schedule
Shared logins sit badly with the requirement for unique credentials and make leavers impossible to manage properly, so we replace them with named accounts and, where needed, shared mailboxes or delegated access.
Administrator accounts done properly
Admin separation is checked at both levels of the scheme. Good practice looks like this:
- Day-to-day accounts have no admin rights on their own devices or in the cloud tenant
- Each administrator has a separate, named admin account, protected by MFA, used only when an admin task needs it
- Admin accounts have no mailbox or are blocked from browsing where the platform allows
- Local administrator passwords on PCs are unique per device, managed with a tool such as Windows LAPS
- Privileged roles in Microsoft 365 or Google Workspace are reviewed regularly and kept to as few people as possible
Third-party, MSP and contractor accounts
Every account your organisation owns is in scope, even if a supplier, contractor or managed service provider uses it to support your systems. If someone else administers your infrastructure remotely, you must be able to confirm that the Cyber Essentials controls are met for that access and show it in your answers.
That usually means named accounts for each engineer, MFA on every one, a record of who has access, and prompt removal when the contract or the individual changes. Our page on Cyber Essentials for MSPs covers this from the provider's side.
Authentication: MFA, passwords and passwordless
How users prove who they are is part of this control. The headlines:
- MFA is required for cloud services and strongly advised for admin and internet-facing accounts; the password element must be at least 8 characters. Missing MFA on a cloud service that offers it is an automatic fail under Danzell. See Cyber Essentials MFA
- Passwords need brute-force protection and a technical control on quality, with no forced expiry or complexity rules. See Cyber Essentials password requirements
- Passwordless methods are recognised: passkeys (including FIDO2 authenticators, which count as MFA), biometrics, security keys and smart cards, push notifications and one-time codes
Tools such as Cisco Duo MFA and Duo Passwordless can add these methods to systems that lack them.
How Cyber Essentials Plus checks access control, and how we help
Cyber Essentials Plus includes two access tests. Test case 4 checks MFA configuration: the assessor watches sampled users sign in to each cloud authentication service from an untrusted device or private browser session, and the test passes only if MFA is requested before access is granted. Cloud services are sampled with at least one standard and one admin user each. Test case 5 checks account separation: a standard user tries to run an administrative process, and it should demand a separate admin login rather than run with the user's own account. The Cyber Essentials Plus requirements page describes all five tests.
We review every account in your directory and cloud tenants, remove stale and shared logins, separate admin roles, roll out MFA and write the joiner, mover and leaver process with you. Contact us to get started, or return to the Cyber Essentials requirements overview.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can administrators use their admin account for email in Cyber Essentials?
No. Admin accounts must be separate and used only for administrative tasks. Email, web browsing and other everyday work must be done from a standard account, so that malware opened by mistake does not gain admin rights.
Are shared accounts allowed for Cyber Essentials?
The requirements say users must be authenticated with unique credentials before they get access, which shared logins do not provide. Replace them with named accounts, and use shared mailboxes or delegated access where people need to share work.
Are MSP and IT support accounts in scope for Cyber Essentials?
Yes. All accounts your organisation owns are in scope, even when a supplier or managed service provider uses them. You must be able to confirm that remote administration meets the Cyber Essentials controls.
How quickly must leavers' accounts be removed?
The requirements say accounts must be removed or disabled when no longer needed, such as when someone leaves, but v3.3 does not set a fixed number of days. Disabling accounts on the last working day is the sensible standard.
Is passwordless sign-in allowed for Cyber Essentials?
Yes. Passwordless methods such as passkeys, biometrics, security keys, push notifications and one-time codes are recognised, and FIDO2 authenticators are treated as MFA.