Step 5 of 7
User accounts, admin rights and MFA
This step is about making sure only the right people can get into your systems, with only the access they need.
It also contains the biggest change in the current requirements: multi-factor authentication (MFA) must be switched on for every cloud service that offers it. Missing it on even one service is an automatic fail.
How to do it
Have a simple starter and leaver process
Write down who approves a new account, what access it gets and who sets it up. When someone leaves, block their sign-in on their last day and remove them from every service, not just email.
Give people only the access they need
Review who can open shared drives, SharePoint sites and apps. Use groups, such as Finance or Directors, rather than giving people access one at a time.
Separate admin accounts
Anyone with admin rights should have a separate admin account used only for admin tasks, never for email or web browsing. Everyday users shouldn't be administrators on their own laptops.
Review admins regularly
Every few months, check who has admin rights in Microsoft 365 or Google Workspace and on your devices, and remove any that aren't needed.
Switch on MFA everywhere
In Microsoft 365, use security defaults or conditional access to require MFA. In Google Workspace, enforce 2-step verification. Then work through every service on your cloud services list from step 1, including accounting software, online banking and your domain registrar, and switch MFA on wherever it's offered.
Consider passkeys
Where a service supports passkeys or passwordless sign-in, they're stronger than passwords and count as MFA. The NCSC recommends them, especially for admin accounts.
Common reasons people get caught out
- The owner using an admin account for everyday work
- Accounts for former staff still active
- MFA on email but not on accounting, banking or the domain registrar
Your checklist for this step
- A process for creating and approving accounts
- People only have the access their role needs
- Separate admin accounts, never used for email or browsing
- Admin accounts reviewed regularly
- MFA switched on for every cloud service that offers it
- Leavers' accounts disabled promptly
- Passkeys or passwordless sign-in where available (recommended)
This guide summarises Cyber Essentials Requirements v3.3 for small businesses. It is general guidance, not the official question set. Check the current requirements on the IASME website before you submit. Last updated 2 November 2026.