What Is User Access Control in Cyber Essentials?

What Is User Access Control in Cyber Essentials?

Last updated: 3 October 2026

User access control means people only have the access they need to do their job, and that access is protected properly. It limits the damage when a password is stolen or a mistake is made.

It is the fourth of the five Cyber Essentials technical controls from the National Cyber Security Centre (NCSC), and it is where multi-factor authentication (MFA) comes in.

What Cyber Essentials requires

• Every user account approved and tied to a named person, with no shared logins.
• Administrator accounts used only for administration, never for email or web browsing.
• Multi-factor authentication turned on for all cloud services that support it, and for administrator accounts.
• Strong password rules followed: long, unique and not easy to guess, with protection against repeated guessing.
• Accounts removed or disabled as soon as they are no longer needed, and access reviewed regularly.

Where businesses most often slip up

• Staff with admin rights on their everyday accounts.
• MFA available in Microsoft 365 but not switched on for every user.
• Shared mailbox or system logins that several people use.
• Leavers and old contractors whose accounts are still active.

How ABCOM helps

We set up least-privilege access, separate admin accounts and MFA across Microsoft 365 and your other cloud services, and we tidy up accounts that are no longer needed. We can also review who has access to what, which is the foundation of both Cyber Essentials and good data protection.

This is one of the five Cyber Essentials technical controls. Not sure whether your business would pass? Take our free 4-minute readiness quiz, or book a free cyber security review.