User access control
Protecting user accounts and helping prevent misuse of privileged accounts is essential for any cyber-secure system or network. User accounts, particularly those with special access privileges (such as administrative accounts), should be assigned only to authorised individuals, managed effectively, and provide the minimum level of access to applications, computers and networks.
Any organisation whose employees connect to the internet needs some level of access control in place. Access controls authenticate and authorise individuals to obtain information that they are permitted to see and use. Without appropriate access control there is no data security.
 Why are access controls important?
Put simply, access control is the selective restriction of access to data. It consists of two elements:
- Authentication – a technique used to verify the identity of a user.
- Authorisation – determines whether a user should be given access to data.
To be effective, access control requires the enforcement of robust policies. This can be difficult when most organisations operate in hybrid environments where data is mobile and moves between on-premises servers, cloud services, offices and beyond.
Organisations must determine the most appropriate access control model to adopt based on the type and sensitivity of the data they are processing.
Privileged accounts
Accounts with privileged access are a prime target for cyber criminals. This is because they offer more access compared to normal users, enabling unrestricted access to sensitive information as well as administrative rights to gain control of the network.
Convenience sometimes results in many users having administrative rights, which can create opportunities for exploitation. If someone logged in with an administrative account opens a malicious link or attachment, any malware is likely to run with the same privileges, which lets it do far more damage than it could from a standard account. User accounts with special access privileges should only be assigned to authorised individuals and managed effectively.
New to the Cyber Essentials scheme?
If a customer, a tender or an insurer has asked you for Cyber Essentials, the certificate checks five technical controls. Cyber Essentials is a UK government-backed scheme: the NCSC (National Cyber Security Centre), part of GCHQ, owns it, and IASME (The IASME Consortium) is its delivery partner.
Certification is what lets you bid for tenders, join supplier lists and renew with customers that require it.
The Scheme is updated every year. Read about the latest changes to the Scheme.
What does the Cyber Essentials user access control require?
One of the Scheme’s five controls is user access control. Its aim is to make sure that user accounts are assigned to authorised individuals only, and that they provide access only to the applications, computers and networks the user needs to carry out their role. It applies to servers, desktop computers, laptops, tablets, mobile phones and cloud services.
Your organisation must be in control of its user accounts and the access privileges that give access to organisational data and services. That includes accounts used by third parties, such as suppliers, contractors and MSPs (managed service providers). Your organisation must:
- Have a process in place to create and approve user accounts;
- Authenticate users with unique credentials before granting access to applications or devices;
- Remove or disable user accounts when they are no longer required, for example when a user leaves the organisation or after a defined period of account inactivity;
- Implement MFA (multifactor authentication) where available, and always use MFA to authenticate to cloud services;
- Use separate accounts to perform administrative activities only, with no emailing, web browsing or other standard user activities that could expose administrative privileges to avoidable risks; and
- Remove or disable special access privileges when they are no longer required, for example when a member of staff changes role.
Your IT team or MSP will usually make these changes, so make sure they are part of the conversation.
Multifactor authentication
MFA is a method of authenticating a user that uses two or more verification factors. The NCSC says you should always use it for administrative accounts and for accounts that are accessible from the internet.
Under the Danzell question set (the 2026 Cyber Essentials question set), MFA is mandatory for all cloud services where it is available. If you don’t use it, whether it is free, included or a paid option, you fail the assessment automatically. For Cyber Essentials, a cloud service is an on-demand, scalable service, hosted on shared infrastructure and accessed over the internet through an account, which stores or processes your organisation’s data. Cloud services can’t be excluded from scope.
The password element of MFA must be at least eight characters long, with no maximum length. The additional factor can be:
- A managed or enterprise device;
- An app on a trusted device;
- A physically separate token; or
- A known or trusted account.
SMS isn’t the most secure type of MFA, but it is far better than no MFA at all. If another option works for your organisation, use it instead.
Passwordless authentication
Passwordless authentication verifies a user’s identity with a factor other than a password. Examples include passkeys (which include FIDO2 authenticators), biometric authentication, security keys or tokens, push notifications and one-time codes. Cyber Essentials regards FIDO2 authenticators as MFA, because the user is authenticated.
Password-based authentication
Where authentication uses a password, your organisation should:
- Protect against brute-force password guessing by using at least one of the following:
- MFA;
- Throttling the rate of attempts, so that the wait between attempts increases with each unsuccessful attempt, allowing no more than ten guesses in five minutes; or
- Locking the device after no more than ten unsuccessful attempts;
- Use technical controls to manage the quality of passwords, by using one of the following:
- MFA;
- A minimum password length of at least 12 characters, with no maximum length restriction; or
- A minimum password length of at least eight characters, with no maximum length restriction, and automatic blocking of common passwords using a deny list;
- Support users to choose unique passwords for their work accounts by:
- Educating people about avoiding common passwords, such as a pet’s name, common keyboard patterns or passwords they have used elsewhere;
- Encouraging people to choose longer passwords by using multiple words (a minimum of three);
- Providing usable, secure storage for passwords, such as a password manager or a locked cabinet, with clear information about how and when to use it;
- Not enforcing regular password expiry; and
- Not enforcing password complexity requirements; and
- Have an established process to change passwords promptly if you know or suspect that a password or account has been compromised.
Find out more about the Cyber Essentials scheme
The five Cyber Essentials controls
Learn more about firewalls
Learn more about security update management
Learn more about malware protection
Learn more about user access control
Learn more about secure configuration
