Trust centre
Which controls My1Login helps you meet, and the evidence for each.
A control-by-control mapping of My1Login to ISO/IEC 27001:2022, the NCSC Cyber Assessment Framework, Cyber Essentials and DORA, with the evidence you can give an auditor. Checked against the current text of each framework in November 2026.
Capabilities
What My1Login does, and the evidence it produces.
Each capability is part of the product today. The framework tables below refer to them by code.
| Capability | What it does | Evidence |
|---|---|---|
| A1 Directory-driven provisioning | Access to applications and credentials follows Active Directory and Entra ID group membership, for joiners, movers and leavers. | Group policy configuration; audit trail of access granted and removed |
| A2 Access policies | Access limited by time of day, period, IP address and network. | Policy configuration; audit trail |
| A3 Workgroups and sharing permissions | Credentials available only to workgroup members; owners set whether a recipient can use, view, update, delete, share on or take ownership. | Workgroup membership and sharing records; audit trail |
| A4 Use without seeing | People sign in with passwords they never see, so they can't write down, reuse or disclose them. | Policy configuration |
| B1 Zero Login | People are signed in to My1Login by signing in to Windows, Active Directory or Entra ID, whatever method they use there, including FIDO2 security keys, passkeys, Windows Hello, smart cards and certificates. | Your directory sign-in policy |
| B2 MFA and step-up | MFA set per user, group, application, location and network; re-authentication or an MFA challenge before a sensitive credential is released. | Policy configuration; audit trail |
| B3 Single sign-on | SAML and OpenID Connect where applications support them. | Application configuration |
| B4 Authenticator code automation | One-time codes generated and filled in automatically. | OTP discovery report |
| B5 Passkey management | Passkeys created and stored in My1Login, shared with workgroups under limited permissions, and closed to leavers. | Audit trail of passkey use |
| B6 Lockout | Accounts locked after repeated failed sign-in attempts, configurable to 10 attempts or fewer. | Policy configuration |
| C1 Strong generated passwords | Long, random passwords changed by policy. | Password strength report |
| C2 Domain-bound autofill | Credentials filled in only on the registered application, never on a look-alike site. This is the default behaviour of the My1Login plug-in. | Product description document |
| C3 Zero-knowledge encryption | AES-256 encryption on the client; keys stay inside your network; My1Login can't decrypt your data. | Architecture statement; penetration test summary |
| D1 Audit trail | A record of every access to every application and credential. | Audit log export |
| D2 Reports | Standard and custom reports, including password strength. | Report exports |
| D3 Discovery | Shadow IT discovery (applications IT doesn't manage) and OTP discovery (where authenticator codes are held). | Discovery reports |
| D4 SIEM integration | Logs exported or streamed to your SIEM. | SIEM configuration; log records |
| E1 Independent assurance | Cyber Essentials Plus; penetration testing by CREST-approved testers, rated A+; ISO 27001-certified hosting; UK data centre option; G-Cloud 8 to 13 supplier. | Security pack: Cyber Essentials Plus certificate, penetration test summary letter (under NDA), DPA, NCSC Cloud Security Principles statement |
| E2 Availability | 99.9% contracted availability. | Contract |
My1Login supports your compliance; it doesn't make an organisation compliant on its own. The controls remain your responsibility.
ISO/IEC 27001:2022
Annex A controls My1Login supports.
Mostly in access control, authentication, cryptography and logging. My1Login's hosting is ISO 27001 certified, and My1Login expects to complete its own certification in 2027.
| Annex A control | How My1Login supports it | Capabilities |
|---|---|---|
| 5.3 Segregation of duties | Sharing permissions separate using a credential from viewing, changing or sharing it, so one person can't hold every right. | A3, A4 |
| 5.9 Inventory of information and other associated assets | Shadow IT discovery shows the applications in use, including those IT doesn't manage. | D3 |
| 5.15 Access control | Access rules set by group, time, network and relationship to the credential. | A1, A2, A3 |
| 5.16 Identity management | Identities come from your directory; there are no separate My1Login identities to manage. | A1, B1 |
| 5.17 Authentication information | Passwords generated, changed by policy and hidden from users; codes and passkeys held in My1Login, not on personal devices. | A4, B4, B5, C1 |
| 5.18 Access rights | Rights granted and removed with directory group membership; sharing permissions limit what each recipient can do. | A1, A3, D1 |
| 5.19 to 5.22 Supplier relationships | The security pack and SLA support your assessment of My1Login as a supplier. | E1, E2 |
| 5.23 Information security for use of cloud services | Single sign-on and managed credentials across cloud applications; independent assurance for My1Login as a cloud service. | B3, C1, E1 |
| 5.30 ICT readiness for business continuity | 99.9% contracted availability. | E2 |
| 6.5 Responsibilities after termination or change of employment | Leavers lose access to applications, passwords, codes and passkeys when they're removed from directory groups. | A1, B5, D1 |
| 8.2 Privileged access rights | Admin and shared account credentials held in workgroups, hidden from users, released after step-up and audited. | A3, A4, B2, D1 |
| 8.3 Information access restriction | Access limited to workgroup members, approved networks and set times. | A2, A3 |
| 8.5 Secure authentication | Directory sign-in with any method you use; MFA and step-up; lockout; domain-bound autofill. | B1, B2, B6, C2 |
| 8.11 Data masking | Passwords are filled in without ever being shown to users. | A4 |
| 8.12 Data leakage prevention | Users can't disclose passwords they never see, and credentials are filled in only on the registered application, never on a look-alike site. | A4, C2 |
| 8.15 Logging | Every access to every application and credential recorded. | D1 |
| 8.16 Monitoring activities | Logs streamed to your SIEM for monitoring and alerting. | D4 |
| 8.24 Use of cryptography | Client-side AES-256 encryption with keys kept in your network. | C3 |
NCSC Cyber Assessment Framework
CAF principles My1Login supports.
Objectives A (managing risk), B (protecting against attack) and C (detecting events), checked against CAF v4.0. Contributing outcomes are shown where one outcome applies.
| CAF principle | How My1Login supports it | Capabilities |
|---|---|---|
| A4.a Supply chain | The security pack, independent testing and SLA support your assessment of My1Login as a supplier. | E1, E2 |
| B2.a Identity verification, authentication and authorisation | Directory sign-in with any method you use; MFA and step-up; access by group, time, network and workgroup. | A1, A2, A3, B1, B2 |
| B2.c Privileged user management | Admin and shared credentials held in workgroups, hidden, released after step-up and audited. | A3, A4, B2, D1 |
| B2.d Identity and access management (IdAM) | Access granted and removed with directory group membership, including leavers. | A1, B5, D1 |
| B3.c Stored data | Credentials encrypted on the client with AES-256; keys stay in your network. | C3 |
| B4 System security | Strong, hidden, generated passwords; domain-bound autofill; lockout. | A4, B6, C1, C2 |
| B6 Staff awareness and training | People can't disclose or reuse passwords they never see, and autofill won't work on phishing sites, so less rests on their judgement. | A4, C2 |
| C1 Security monitoring (C1.a sources and tools, C1.b securing logs) | A complete audit trail streamed to your SIEM; shadow IT discovery. | D1, D3, D4 |
Cyber Essentials
The user access control requirements My1Login supports.
Checked against Requirements for IT Infrastructure v3.3 (April 2026). My1Login holds Cyber Essentials Plus itself. The other four controls (firewalls, secure configuration, security update management and malware protection) apply to your devices and networks.
| Requirement (user access control) | How My1Login supports it | Capabilities |
|---|---|---|
| Accounts only for authorised users, removed when no longer needed | Access follows directory group membership, so leavers lose access to applications and credentials when they're removed. | A1, D1 |
| Special access privileges removed when no longer required | Access by group, workgroup, time and network; sharing permissions limit what each recipient can do. | A2, A3 |
| Separate accounts used only for administrative activities | Helps protect administrative accounts: admin credentials held in restricted workgroups, released after step-up and audited. Using separate accounts for admin work remains your own practice. | A3, B2, D1 |
| MFA where available; cloud services must always use MFA | MFA into My1Login and step-up for applications; authenticator codes generated and filled in, so MFA can be switched on even for shared accounts. v3.3 counts passkeys and FIDO2 authenticators as MFA, and Zero Login works with them at directory sign-in. | B1, B2, B4, B5 |
| Password-based authentication: minimum length and protection against brute-force attacks | Long, random passwords generated and changed by policy; lockout configurable to 10 failed attempts or fewer; password strength reporting as evidence. | B6, C1, D2 |
DORA
DORA requirements My1Login supports.
DORA (Regulation (EU) 2022/2554) applies to EU financial entities, including UK firms with EU operations. The ICT risk management detail is in Delegated Regulation (EU) 2024/1774 (RTS).
| Article | How My1Login supports it | Capabilities |
|---|---|---|
| DORA Art. 9: protection and prevention, including strong authentication and limits on logical access | Directory sign-in with any method you use; MFA and step-up; access by group, time, network and workgroup. | A1, A2, A3, B1, B2 |
| DORA Art. 10: detection of anomalous activity | An audit trail streamed to your SIEM. | D1, D4 |
| DORA Art. 28 to 30: ICT third-party risk and contractual provisions | The security pack, independent testing, data processing agreement, SLA and UK data centre option. | E1, E2 |
| RTS Art. 6 and 7: encryption and cryptographic key management | Client-side AES-256 encryption; keys stay in your network. | C3 |
| RTS Art. 12: logging | Every access to every application and credential recorded and exportable. | D1, D4 |
| RTS Art. 20: identity management | Identities and the access lifecycle driven by your directory, including leavers. | A1, B5 |
| RTS Art. 21: access control, including privileged access and strong authentication | Least privilege through workgroups and sharing permissions; hidden credentials; step-up for sensitive applications. | A3, A4, B2 |
My1Login supports your compliance; it doesn't make an organisation compliant on its own.
Send us your security questionnaire.
Our team will complete it, walk your security team through how My1Login works, and show you the zero-knowledge model on your own apps.
- Your questionnaire, completed for you
- A specialist replies within one working day
- Documents shared under NDA where needed
Talk to our security teamBook a 5-minute demoSee it on your own apps.