User access control: the section that’s really about habits

The shape of the section

Section A7 asks about the whole life of an account: how it is created (A7.1), that it belongs to one person (A7.2), how it dies when someone leaves (A7.3), that it can only reach what the job needs (A7.4), how administrator rights are granted, separated, tracked and reviewed (A7.5–A7.9), how logins resist guessing (A7.10–A7.11), what staff are told about passwords (A7.12), and what happens when something leaks (A7.13). The MFA questions (A7.14–A7.17) sit at the end, and three of them (A7.15–A7.17) are automatic fails — but assessors read the whole section, and vague answers here cost people too.

Accounts are born through a decision (A7.1)

The question is whether logins appear through a set way with sign-off from someone in a leadership role, or just… appear. For a small business a good answer is one sentence that names names: “the owner approves the hire; the office manager creates accounts in Microsoft 365 and Xero with the access the role needs.” Write it down once and you also have the start of your joiner process — the free joiner & leaver template is that page.

One person, one login (A7.2)

Shared logins break A7.2 outright — accounts must not be shared — and undermine every other question too: you can’t remove a leaver from an account four people share, and MFA to one phone locks the other three out. The usual offender is info@ run as a mailbox several people sign into — convert it to a shared or delegated mailbox that named people open from their own accounts (both Microsoft 365 and Google Workspace are built for this), and the problem dissolves. The shared accounts guide covers the other common cases.

Leavers, the same day (A7.3)

When someone leaves, their access is disabled promptly in every tool — same day is the habit worth committing to, and the drafted process commits to it. The practical trick is the joiner note: if you wrote down what someone was given on day one, switching it off is a checklist rather than a hunt. Don’t forget shared knowledge either — Wi-Fi and router admin passwords a leaver knew get changed.

Least privilege (A7.4)

People have access to what their job needs, not everything the business has. In small-business terms: the bookkeeper sees the accounts, not the HR folder; the new starter gets the project drive, not the whole server. Most cloud tools make this a sharing setting, not an IT project — the honest work is deciding, once, who needs what.

Administrators: separate, listed, reviewed (A7.5–A7.9)

Admin rights are granted deliberately (A7.5), used from a separate admin account rather than the everyday one (A7.6), and that admin account is never used for browsing or email (A7.7) — because an admin session that opens a bad attachment hands over the keys. You keep a simple written list of who has admin on what (A7.8), and you re-read it on a cycle — quarterly is comfortable — removing anyone who no longer needs it (A7.9). In a five-person business this is one person with two accounts and a three-row table; the point is that it exists and gets read. If an IT provider holds admin on your systems, their account is on your list.

Guessing, passwords and compromises (A7.10–A7.13)

Logins resist brute force by MFA, throttling (no more than 10 guesses in 5 minutes), or lockout after no more than ten attempts (A7.10); password quality comes from one of the three accepted controls (A7.11) — the password guide covers both, and the free generator writes the policy. Staff get practical guidance — three random words, never reuse, use the password manager (A7.12) — and everyone knows that a suspected leak is reported immediately, no blame, so the password gets changed while it matters (A7.13).

The one-afternoon version

1. Convert shared logins to shared mailboxes; give everyone their own account.
2. Create separate admin accounts; strip admin rights from everyday ones.
3. Write the three-row admin table and the one-page joiner/leaver process.
4. Check leaver hygiene: does any ex-staff account still work anywhere?
5. Then do MFA across every service — the part that auto-fails.