Cyber Essentials - Shared Cover Accounts

[Frodo_Baggins]

How do you manage Cover accounts in 365 whilst being cyber essentials certified?

The accounts are currently setup per site and then shared with cover teachers by the cover manager.

 

The current plan to meet requirements is to run a scheduled task every night to reset the password and email it to the cover manager to then be distributed.

[Rob_D]

We don't use shared accounts, if they're on contract they get their own account. But we do most cover internally so we don't get many ad-hock supply teachers. In the past, we've had scripts that disable the cover accounts at the end of each day, but it was normally more trouble than it's worth.

[Bedders]

Going through CE Basic/Plus right now. Not a school but the answer still applies, as we had similar query to IASME. Basically shared accounts are a fail. Even if you have a password manager used to log in to a shared account, which provides a record of who enters/accesses a password, it's a hard requirement. Therefore I doubt you'll get away with it but it may be worth enquiring with your assessor.

 

Quote

Cyber Essentials is a prescriptive accreditation, the controls need to be implemented as stated. This would be considered account sharing, and this is not permissible within the scheme.
Also, should a member of staff not use the autofill, and enter the credentials manually, presumably, it would not be audit logged

 

[paulkerton]

16 hours ago, Frodo_Baggins said:

How do you manage Cover accounts in 365 whilst being cyber essentials certified?

They get their own account. No generic accounts with direct logins else you fail CE. The only generic accounts we have (that aren't groups) are delegated access only, no one knows the passwords and they're behind 2 factor authentication enforcement.

Edited August 21, 2025 by paulkerton

[msi_school]

3 minutes ago, paulkerton said:

They get their own account. No generic accounts with direct logins else you fail CE. The only generic accounts we have (that aren't groups) are delegated access only, no one knows the passwords and they're behind 2 factor authentication enforcement.

 

So how does this work with temp supply staff?

• Single use accounts
• Setting up the account on the day
• No IT for temp staff

 

[Frodo_Baggins]

We have a lot of adhoc supply and vey little in house supply.

 

So cover manager calls agency and they send someone that morning (should have mentioned that) - what do you guys do with this? Do you still make individual accounts for them when cover manager tells you their name? 

[FN-GM]

12 minutes ago, Frodo_Baggins said:

So cover manager calls agency and they send someone that morning (should have mentioned that) - what do you guys do with this? Do you still make individual accounts for them when cover manager tells you their name? 

 Pretty much - apart from the account creation was automated. Data came from the personnel management system.

[paulkerton]

2 hours ago, msi_school said:

 

So how does this work with temp supply staff?

• Single use accounts
• Setting up the account on the day
• No IT for temp staff

 

 

Officially - They're set up on the day of their arrival once we've confirmed who it is.
Unofficially - I'm sure shortcuts are taken that I'm not aware of. To generalise, we know many, many people in education treat laws, policies and official guidance as an optional extra if it gets in the way of their personal objectives.

[psydii]

Every supply teacher is issued a numbered laptop from a pool. With the laptop they are issued a numbered generic account "locked" to that laptop. The generic account has limitations that full staff do not. Specifically we have limitations that applied to any account/user where they have not completed our internally delivered statutory training (including Data Protection). These generic accounts are always restricted. If the supply teacher is here for any significant length of time, their details are processed by hr and they are issued access to the training materials and their own dedicated account.  The generic supply account passwords are rotated periodically.

[Rob_D]

36 minutes ago, Frodo_Baggins said:

So cover manager calls agency and they send someone that morning (should have mentioned that) - what do you guys do with this?

If you're using the same agency, do you not wind up getting the some of the same supply teachers over and over? Could that be arranged?

If you're rotating through the same dozen or so supply teachers, then there's no reason they can't have their own account that just needs unlocking when they come in again.

[msi_school]

I agree that generic accounts put the network at danger however, staff not having access to the MIS and assorted information creates a safeguarding issues.

 

I used to be in charge of managing cover and tried to use a small number of staff I knew where good however, when booking at short notice you get the staff that are available.

 

As we all know this is the case and we allknow that the school dont want to wait for accounts to be created what are the options?

 

• Do we just say no it breaks cyber essentials.

 The staff did not break the speed limits to get to work and this is accepted.

• Create accounts once the staff have arrived.

Ties up a lot of staff time

• Create single use accounts in advance and reconsile them to the member of staff once used.

It is likly that the admin will not be done in a timely manner.

Edited August 21, 2025 by msi_school
spelling

[Rob_D]

3 minutes ago, msi_school said:

staff not having access to the MIS and assorted information creates a safeguarding issues.

Hang on a minute? Generic network accounts are one thing, but generic MIS accounts? That's a DP/Safeguarding breach wating to happen.

[FN-GM]

How do you use MFA with generic accounts?

[dmj]

5 minutes ago, FN-GM said:

How do you use MFA with generic accounts?

With bitwarden you can share MFA codes

[psydii]

Treat the laptop (and that it is in school) as the second factor.

[msi_school]

34 minutes ago, Rob_D said:

Hang on a minute? Generic network accounts are one thing, but generic MIS accounts? That's a DP/Safeguarding breach wating to happen.

 

What is to stop any member of staff from creating a DP/Safguarding issue in the MIS. Their training, profesionalism and ethics qualities which are seperate from their log on credentials.

 

Safeguarding is not a tick box exercise it is an ongoing risk assesment.

 

• Can we provide the required access for short notice staff or is this not safe?
• If we can provide access how do we do it?
• If we can not how do we manage this?

I know I dont have the answers to these questions.

 

 

[msi_school]

41 minutes ago, FN-GM said:

How do you use MFA with generic accounts?

A physical token 

[paulkerton]

3 hours ago, msi_school said:

I agree that generic accounts put the network at danger however, staff not having access to the MIS and assorted information creates a safeguarding issues.

 

I used to be in charge of managing cover and tried to use a small number of staff I knew where good however, when booking at short notice you get the staff that are available.

 

As we all know this is the case and we allknow that the school dont want to wait for accounts to be created what are the options?

 

• Do we just say no it breaks cyber essentials.

 The staff did not break the speed limits to get to work and this is accepted.

• Create accounts once the staff have arrived.

Ties up a lot of staff time

• Create single use accounts in advance and reconsile them to the member of staff once used.

It is likly that the admin will not be done in a timely manner.

 

Then you will not pass Cyber Essentials. 🤷‍♂️

[psydii]

I'd argue that an account tied (restricted) to a specific piece of secured hardware, with an audit trail of who is holding that hardware at any given time, with a regularly rotated password is not in fact a shared account as per the intention of the requirements.

 

Sometime I lose these sorts of arguments, but usually* someone pragmatic makes and amendment/update to the rules to match my expectation.

 

*eventually

[msi_school]

5 hours ago, paulkerton said:

 

Then you will not pass Cyber Essentials. 🤷‍♂️

I understand your point but I am looking for a way to do both, I suggested three options all of which I believe are compatible with Cyber essentials. Do you have an opinion on them?

 

4 hours ago, psydii said:

I'd argue that an account tied (restricted) to a specific piece of secured hardware, with an audit trail of who is holding that hardware at any given time, with a regularly rotated password is not in fact a shared account as per the intention of the requirements.

 

Sometime I lose these sorts of arguments, but usually* someone pragmatic makes and amendment/update to the rules to match my expectation.

 

*eventually

 

I agree with your understanding of this situation but like you I am not a Cyber Essentials evaluator. I was hoping here was.

[jmak]

15 hours ago, msi_school said:

I understand your point but I am looking for a way to do both, I suggested three options all of which I believe are compatible with Cyber essentials. Do you have an opinion on them?

 

 

I agree with your understanding of this situation but like you I am not a Cyber Essentials evaluator. I was hoping here was.

I would run the argument that it's not a shared account - only one person at a time knows the credentials so you can always identify who used the computer. When you submit your application you're entitled to an hour of advice -  I'd use that opportunity to ask before you submit your answers.

 

 

[Frodo_Baggins]

Thank you for the insights, If a daily unique password\geoip and hardware restrictions are not sufficient when we get that hour of advice then I'll set a script to create\ delete accounts on a daily basis and then look at MIS requirements