Admin interface
An admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page. Cyber Essentials requires firewall admin interfaces to be unreachable from the internet unless there is a documented business need and MFA or an IP allow list protects them, asked at A4.9 to A4.11.
- Term
- Admin interface
- Also known as
- Administrative interface, Management interface, Web admin page, Remote management
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls
- Reviewed against
- Requirements v3.3
What does the term admin interface mean in Cyber Essentials?
An admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.
prevent access to the administrative interface (used to manage firewall configuration) from the internet, unless there is a clear and documented business need, and the interface is protected by one of the following controls:
How does admin interface apply to Cyber Essentials?
In plain terms
Every router and firewall has a control panel. Usually you reach it by typing an address into a web browser while you are in the office, then logging in. Whoever gets into that control panel can change every rule, so it is the most valuable door on the device. Some suppliers switch on "remote management" so they can reach it from their own office over the internet.
What Cyber Essentials asks
The requirement, quoted above, lists two acceptable protections: "multi-factor authentication" or "an IP allow list that limits access to a small range of trusted addresses combined with a properly managed password authentication approach".
The question set splits this into three:
- A4.9: "Are your boundary firewalls configured to allow access to their configuration settings over the internet?" If only reachable over a VPN, the guidance says answer No.
- A4.10: if Yes, "is there a documented business requirement for this access?"
- A4.11: if Yes, is access protected by MFA or by trusted IP addresses with managed authentication.
The default admin password must also be changed (A4.2), and A4.3 asks how the firewall password is set up.
Common mistakes
- Remote management left on by a previous IT supplier, which nobody now uses.
- An allow list that covers far more than "a small range of trusted addresses".
- No written business requirement, which leaves A4.10 as No.
For Cyber Essentials Plus, an admin login page found on the internet in test case 1 will be judged against these rules.
See the firewall requirements and A4.9. Related: default password, static IP address, multi-factor authentication.
Related terms
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
- Static IP addressA static IP address is a public internet address that stays the same over time, unlike a dynamic address that your broadband provider can change without notice.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- Boundary firewallA boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
- Corporate VPNA corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply.
- DMZ (demilitarised zone)A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach.
Frequently asked questions
An admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, admin interface comes up at A4.9, A4.10, A4.11. Read those questions against the definition above so your answers use the term the way the assessor will.
Admin interface relates to 1. Firewalls in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.