Willow A7.4

Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?

Section A7: User Access Control  ·  Cyber Essentials Willow

Danzell extended this to explicitly include cloud service permissions — AWS IAM roles, Google Workspace admin rights, and equivalent cloud access rights must be governed by the same least-privilege principle.

What this question is really asking

Confirm that users only have the access rights needed to do their current role — the principle of least privilege. Assessors look for a defined process for granting, reviewing, and revoking access. Common failures include users retaining access from previous roles, over-privileged default setups, and no regular access review.

What satisfies this requirement

Yes or No — if Yes, a written description is also required

Least privilege principle must be applied. Privileges updated when staff change roles.

Check how you answer this in the CE Explorer
Free tool — all 288 questions mapped across every CE version.
Open CE Explorer

What to prepare before your assessor visit

Access reviews are often the least developed process in smaller organisations. Having a process for granting access is common; having a process for reviewing and revoking access when it is no longer needed is far less common. Assessors will ask specifically about your access review cycle — what triggers a review, who conducts it, what the output looks like, and what happens with the results.

How this question sits across CE versions

Willow You are here
Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?
Montpellier evolved View →
Do you ensure that staff only have the privileges that they need to do their current job? How do you do this?
Danzell View →
Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?

Related policy templates

Getting certified means having documentation to back it up. These policy templates cover the controls this question tests.

Access Control Policy
Governs how user and administrator accounts are created, maintained, reviewed, and remove…
← Previous
A7.3
How do you ensure you have deleted, or disabled, any accounts for sta…
Next →
A7.5
Do you have a formal process for giving someone access to systems at …

Does your organisation meet this requirement?

Answer 30 plain-English questions and find out exactly where you stand across all 5 Cyber Essentials control areas — with a prioritised list of what to fix first.

Check my readiness → Explore all questions first