Montpellier A5.8

Is 'auto-run' or 'auto-play' disabled on all of your systems?

Section A5: Secure Configuration  ·  Cyber Essentials Montpellier

Changed in Danzell — the scope of auto-execution prevention was broadened to cover additional file types and execution contexts. Review your current configuration against the Danzell requirements document even if you passed this in Willow.

What this question is really asking

Confirm that your devices are configured to prevent automatic execution of files downloaded from the internet or imported from removable media. This prevents drive-by downloads and USB-borne malware from running without user interaction. Danzell significantly broadened the scope of this requirement to cover additional file types and execution paths beyond those covered in Willow.

What satisfies this requirement

Yes or No

Acceptable to use 'prompt user' option rather than full disable.

Check how you answer this in the CE Explorer
Free tool — all 288 questions mapped across every CE version.
Open CE Explorer

What to prepare before your assessor visit

This is an area where many organisations thought they'd passed under the Willow requirements but may have gaps under Danzell, which extended the scope to additional file types and execution contexts beyond just executables. Review your current configuration specifically against the Danzell requirements document — even if you passed this control in a previous assessment under an earlier version of the standard.

How this question sits across CE versions

Montpellier You are here
Is 'auto-run' or 'auto-play' disabled on all of your systems?
Willow changed View →
Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?
Danzell View →
Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?

Related policy templates

Getting certified means having documentation to back it up. These policy templates cover the controls this question tests.

Acceptable Use Policy
Sets out how devices must be configured, what software is permitted, and how users are ex…
← Previous
A5.7
When not using multi-factor authentication, which option are you usin…
Next →
A5.9
When a device requires a user to be present, do you set a locking mec…

Does your organisation meet this requirement?

Answer 30 plain-English questions and find out exactly where you stand across all 5 Cyber Essentials control areas — with a prioritised list of what to fix first.

Check my readiness → Explore all questions first