User access control: what Cyber Essentials needs

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

The six user access control rules in v3.3

Section E.4 of the NCSC Requirements for IT Infrastructure v3.3 (pages 18–22) covers user and administrator accounts across computers, servers and cloud services — including accounts used by third parties such as your IT support provider (Managed Service Provider, or MSP):

1. A formal process to create and approve accounts: New accounts are created only when authorised by management.
2. Unique credentials for every user: Everyone signs in with their own account. Shared logins (such as three people logging in as accounts@) are not permitted because you cannot trace actions or revoke one leaver’s access cleanly.
3. Least privilege: Standard staff accounts get access only to the files, apps and networks needed for their role, and special privileges are removed when someone changes role.
4. Prompt removal of leavers and inactive accounts: Accounts must be disabled or deleted when someone leaves the organisation or after a defined period of inactivity.
5. Separate administrator accounts: Accounts with administrative privileges (whether local computer admin or cloud Global Administrator) must be used only for administrative tasks — never for reading email, browsing the web or everyday office work.
6. Mandatory Multi-Factor Authentication (MFA) on cloud services: Authentication to cloud services must always use MFA wherever the service makes MFA available. Under the April 2026 Danzell rules, missing cloud MFA is an automatic fail.

Why separate admin accounts matter so much

Version 3.3 illustrates this with a simple scenario: if a director or IT manager is logged into their laptop or Microsoft 365 with an administrator account and clicks a malicious link in an email, any malware runs with full administrative rights — allowing it to disable security tools, create rogue accounts or encrypt the entire network. Keeping admin rights in a separate, mailbox-free account (such as admin-ross@...) means everyday phishing emails never run with admin privileges. Read our full guide on admin accounts and Cyber Essentials.

Passkeys, MFA and password rules

Version 3.3 updates the authentication section in two important ways:

• Passkeys and passwordless sign-in: Section B and Section E.4 now explicitly highlight FIDO2 passkeys (cryptographic credentials stored in Microsoft Authenticator, Windows Hello for Business, Apple Passwords or a hardware security key) as passwordless authentication that satisfies the MFA requirement in a single phishing-resistant step.
• Password lengths when passwords are used:
  • With MFA enabled: minimum password length of at least 8 characters, with no maximum length restriction.
  • Without MFA (where MFA is not technically applicable, such as a local account): either at least 8 characters combined with an automatic common-password deny list, or at least 12 characters, protected by brute-force throttling/lockout (maximum 10 guesses in 5 minutes or lockout after 10 attempts).
  • Do not enforce regular password expiry (such as 90-day forced changes) or arbitrary symbol/uppercase complexity rules.

See our deep dives on MFA and cloud services and passwords and device locking.