Answering the secure configuration questions (A5)

The secure configuration questions check that devices and cloud services are not left in their out-of-the-box state. A good answer explains how you remove software and accounts you do not need, confirms default passwords are changed, shows auto-run is disabled, and describes how devices lock. If you host a service that people reach over the internet, you also explain how its login is protected.

Your Certification Body marks the real submission. This is Apexward's guidance from public sources.

What the questions are checking

Unused software and services (A5.1)

Remove or disable applications, utilities and network services that are not needed day to day, on computers, servers, thin clients, phones, tablets and cloud services. The question asks you to describe how. "We remove software when we notice it" is weak. A routine is better.

A good answer: "Laptops are built from a standard Intune image. Users cannot install software. Every quarter our IT provider reviews the installed apps report and removes anything not on the approved list. Unused Microsoft 365 apps and third-party integrations are reviewed at the same time."

Unused accounts (A5.2)

Only accounts used in the normal course of business should exist. Disable guest accounts and remove or disable spare admin accounts, on devices and in cloud services. Name how you check, for example a review of the Microsoft 365 user list when staff leave and every quarter.

Default passwords (A5.3)

Every user and administrator account on computers, servers, thin clients, phones and tablets must have its default or guessable password changed, following the password rules: MFA, at least 12 characters, or at least 8 characters with a deny list of common passwords. Say which rule applies and how it is enforced.

Services you host for internet users (A5.4 to A5.7)

A5.4 asks whether you run or host external services that give users access to non-public data over the internet. Examples are a VPN, a self-hosted mail server, a remote desktop gateway, a client portal, or a SaaS product you sell. Microsoft 365 or Google Workspace that you only use are cloud services covered elsewhere, not services you host. If you answer Yes, you then say:

• which authentication option protects it (MFA, deny list, 12 characters, or passwordless)
• how you change passwords if they may be compromised
• how you stop password guessing, if you are not using MFA: throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts

Auto-run (A5.8)

Turn off features that run files automatically from removable media or downloads without the user agreeing. Asking the user what to do each time is acceptable. On Windows, set AutoPlay to take no action, or turn it off by policy.

Device locking (A5.9 and A5.10)

Devices used in person must need a biometric, password or PIN to unlock, with protection against guessing (throttling, or locking after no more than 10 attempts, or the vendor default where it cannot be configured). If the credential only unlocks the device, a PIN or password of at least 6 characters is enough. If the same credential also signs in to organisational data or services, the full password rules apply.

A good answer: "Windows Hello PIN of at least 6 digits plus a 12-character account password, lockout after 10 attempts by Intune policy. iPhones use a 6-digit passcode and Face ID, enforced by our MDM. Screens lock after 5 minutes."

What assessors typically query

• A5.1 answered with "Yes" and no description.
• A VPN or remote desktop listed elsewhere, but A5.4 answered No.
• 4-digit passcodes on phones or tablets.
• No mention of how personal devices meet the locking rule.

Answers that fail

• Default or guessable passwords left on any account.
• Devices that do not need a credential to unlock.
• An internet-facing login with no brute-force protection or MFA.
• Auto-run left on.

Any non-compliant answer on a requirement fails the assessment, so fix these before you submit.

Checklist

1. Run an installed software report and remove what is not needed.
2. Review device and cloud accounts and disable guests and spares.
3. Change every default password.
4. Turn off auto-run.
5. Set unlock rules, a 6-character minimum PIN, and an idle lock.

Read more in secure configuration and passwords and passkeys.