Meeting Cyber Essentials Access Control Requirements With Password Management That Sticks

Cyber Essentials access control that survives contact with real staff

User access control is one of the five technical control areas Cyber Essentials assesses, and it covers more ground than most businesses initially assume — not just "do you have a password policy," but whether accounts are provisioned with least privilege, whether administrative rights are properly restricted and reviewed, whether multi-factor authentication is actually enforced rather than merely available, and whether leavers' access is removed promptly rather than sitting active for months after someone's left the business. A password policy written in a document and never technically enforced satisfies nobody — not your staff, who ignore it within a month, and not a Cyber Essentials assessor, who will ask for evidence of enforcement, not intention.

Our approach to cyber essentials access control focuses on what's technically enforced across your systems, not what's merely written in a policy nobody has actually read. Multi-factor authentication, least-privilege access, regular permission reviews and prompt leaver deprovisioning are all included as standard on our managed IT plans, from £20 per user per month, alongside 24/7 monitoring and EDR endpoint protection — so the access control evidence a Cyber Essentials assessment asks for reflects what's genuinely happening across your business, not a policy exercise completed once before an assessment and then forgotten.

The name of this page mentions password management specifically because that's usually the starting point businesses actually search for, but the underlying requirement is broader than passwords alone. A good password matters far less than it used to now that multi-factor authentication is available almost everywhere, which is why we treat MFA as the priority layer and password policy as the sensible baseline underneath it, rather than the other way round. Getting that balance right also means staff spend less time fighting overly complex password rules and more time actually protected by a second authentication factor that matters far more.

Access Control vs. a Password Policy Document

A password policy document tells staff what they should do. Cyber essentials access control, properly implemented, makes it technically required — minimum password standards enforced by the system itself, multi-factor authentication that can't simply be skipped, administrative rights genuinely separated from everyday accounts, and leaver access removed the day someone departs rather than whenever someone happens to notice. The comparison that matters isn't policy versus no policy — it's whether access control is actually enforced by your systems, or relies entirely on staff remembering and choosing to follow a document most people read once, if at all. A written policy also can't tell you, months later, whether a leaver's account is still active or whether an intern's temporary access was ever actually revoked — only an enforced, reviewed system can answer those questions with certainty rather than a shrug. Access control, MFA and regular reviews are included as standard on our managed IT plans, from £20 per user per month.