Answering the user access control questions (A7)

The user access control questions check that you are in control of who has accounts and what they can do. A good answer describes a short approval process for new accounts, unique logins for everyone, prompt removal of leavers, limited and separate admin accounts, sensible password rules, and MFA on every cloud service account. The cloud MFA questions are where most automatic fails happen.

Your Certification Body marks the real submission. This is Apexward's guidance from public sources.

What the questions are checking

Creating and removing accounts (A7.1 to A7.4)

• Approval (A7.1). Accounts are only created after someone in a leadership role approves them. Describe the process in a sentence or two, including accounts your IT provider holds.
• Unique credentials (A7.2). Everyone signs in with their own login. No shared accounts on devices, applications or cloud services.
• Leavers (A7.3). Say how you delete or disable accounts when people leave, for example a leaver checklist run on the last day.
• Least privilege (A7.4). Staff have only the access they need for their current job, and access changes when roles change.

A good answer: "New starters are requested by the line manager and approved by a director by email. IT creates the Microsoft 365 account and adds it to the role's groups. On the last day, IT blocks sign-in, resets MFA and removes devices, using our leaver checklist."

Administrator accounts (A7.5 to A7.9)

Admin access needs a formal approval process. Admins use a separate account for admin tasks, covering local, domain and cloud admin roles, and never browse the web or read email with it. You can meet the "no everyday use" rule with policy and training; it does not have to be technical. You also track who has admin accounts and review the list regularly, removing access no longer needed.

A good answer: "Two staff have admin rights. Each has a standard account for daily work and a separate admin account with no mailbox, used only in the Microsoft 365 admin centre and for installs. Admin accounts are listed in our IT register and reviewed every six months by the managing director."

This applies to one-person businesses too: use a standard account day to day and a separate admin account for changes.

Passwords (A7.10 to A7.13)

Where passwords are used, including as a backup to passwordless sign-in:

• protect against guessing with MFA, throttling (no more than 10 guesses in 5 minutes), or lockout after no more than 10 failed attempts
• control password quality with MFA, a 12-character minimum, or an 8-character minimum plus a deny list of common passwords, with no maximum length
• help people choose unique passwords: explain what to avoid, promote three random words, provide a password manager, and do not force regular expiry or complexity rules
• have a process to change passwords promptly when compromise is known or suspected

Cloud service MFA (A7.14 to A7.17)

You are asked whether all your cloud services offer MFA, to list any that offer no MFA at all, and whether MFA is on for every admin and every user of your cloud services. If a service has no MFA of its own but can sign in through another service that does, such as Microsoft Entra ID or Google Workspace, that link must be set up. The password element of any MFA must be at least 8 characters with no maximum.

Passkeys and FIDO2 security keys count as MFA. SMS codes are accepted but discouraged. Restricting sign-in by trusted IP address or location is not MFA.

Assessors check the services you list in A7.15. Listing a service that does offer MFA, even as a paid add-on, is an automatic fail.

What assessors typically query

• Shared mailboxes or "office" logins people sign in to directly.
• Admin rights on everyday accounts, often for a director.
• No mention of how leavers' cloud accounts are disabled.
• A cloud service from the scope list missing from the MFA answers.
• Password expiry still enforced.

Answers that fail

IASME has confirmed that cloud MFA available but not turned on (A7.14 to A7.17) is an automatic fail. Any other non-compliant answer, such as shared accounts or admins working day to day with admin rights, also fails.

Checklist

1. Turn on MFA for every user and admin on every cloud service, including social media and finance tools.
2. Split admin accounts from daily accounts.
3. Write the joiner, mover and leaver steps down.
4. Remove password expiry and complexity rules; set length and a deny list.

Read more in user access control, MFA for cloud services and passwords and passkeys.