User Access Control Compliance
Learn how to manage user privileges, secure administrator accounts, and satisfy the third control of UK Cyber Essentials.
What is User Access Control?
User Access Control is designed to limit the damage that a compromised account or malware infection can cause. By enforcing the Principle of Least Privilege, you ensure that users only have access to the data, applications, and settings required to do their job, and nothing more.
Crucially, administrative privileges must be strictly controlled, as admin accounts have the power to bypass firewalls, install software, and compromise entire domains.
Separation of Duties
Under Cyber Essentials rules, administrators must not use their admin accounts for daily tasks like reading email, browsing the web, or opening documents. Separate standard user accounts must be used instead.
How to Implement Access Controls
Strictly Limit Administrative Accounts
Review all active accounts and ensure that administrator rights are only assigned to authorised IT personnel. Regularly audit account roles and delete or disable stale, unused, or guest accounts.
Enforce Separate Accounts for Admin Work
All administrators must be issued two separate accounts: a standard user account for daily communication/browsing, and a dedicated admin account. The admin account must only be used to perform authorised system changes.
Mandate Multi-Factor Authentication (MFA)
MFA must be enforced across all cloud services (such as Microsoft 365, Google Workspace) and internal administrative portals. This acts as a critical shield if user passwords are ever phished or leaked.
Frequently Asked Questions: User Access & Multi-Factor Authentication
🔑 Which cloud services require mandatory MFA under Cyber Essentials? +
Under the NCSC Danzell standard, 100% of cloud services (including Microsoft 365, Google Workspace, AWS, Xero, and CRM platforms) hosting organisational data require Multi-Factor Authentication for both standard users and administrators. Single-factor logins result in immediate audit failure. Pair this with our Secure Configuration rules.
👤 Can administrators use their admin accounts for daily email and web browsing? +
No. NCSC Cyber Essentials explicitly mandates separation of duties. Admins must have two distinct accounts: a standard user account for email, productivity tools, and web surfing, and a separate privileged account used strictly for administrative maintenance. This prevents drive-by malware from acquiring root privileges, as detailed in our Malware Protection Guide.
📰 What happens if an organisation fails access control? +
Over 80% of UK data breaches originate from compromised user credentials and missing MFA. See our breakdown of recent incidents and supply chain ransomware on the UK Cyber Security News & Breach Insights page.
User Access Control & Cloud MFA Self-Check
1. Mandatory 100% MFA Across All Cloud Services
Multi-Factor Authentication (MFA) must be enforced for 100% of user and admin accounts accessing cloud services (Microsoft 365, Google Workspace, AWS, Azure, and web portals). Authenticator apps, FIDO2 keys, and Windows Hello are fully approved.
2. Strict Separation of Administrative Accounts
Day-to-day computing (web browsing, emails) must never be conducted using an administrative account. Administrators must maintain two accounts: a standard user account for daily tasks and a separate elevated admin account used solely for administrative changes.
3. Prompt Deprovisioning & Least Privilege
Departed staff accounts must be locked or deleted within 48 hours. Access to file shares, databases, and financial portals must follow the principle of least privilege, with regular quarterly access audits.