Boundary firewall
A boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules. Under Cyber Essentials v3.3 every boundary firewall must have its default password changed, block unauthenticated inbound connections, and have inbound rules approved, documented and reviewed. They are listed at A2.5 and questioned at A4.1 to A4.11.
- Term
- Boundary firewall
- Also known as
- Perimeter firewall
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls
- Reviewed against
- Requirements v3.3
What does the term boundary firewall mean in Cyber Essentials?
A boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
A boundary firewall is a network device which can restrict the inbound and outbound network traffic to services on its network of computers and mobile devices. It can help protect against cyber attacks by implementing restrictions, known as ‘firewall rules,’ which can allow or block traffic depending on its source, destination and type of communication protocol.
How does boundary firewall apply to Cyber Essentials?
In plain terms
The boundary firewall is the front door between your office network and the internet. In a small office it is often the firewall built into the broadband router. In a larger one it is a dedicated appliance. Everything behind it is shielded from unsolicited traffic, as long as its rules are right.
What Cyber Essentials asks
The firewalls section defines it in the wording quoted above. Every boundary firewall must:
| Requirement | Question |
|---|---|
| Be listed with make, model and quantity | A2.5 |
| Be in place between your internal networks and the internet | A4.1 |
| Have its default admin password changed, including unique pre-set ones | A4.2 |
| Use a password that meets one of the password options, or MFA | A4.3 |
| Have its rules reviewed, with unneeded ones removed | A4.6 |
| Block unauthenticated inbound connections by default | A4.7 |
| Have each allowed inbound rule approved and documented with its business need | A4.8 |
| Keep its admin interface off the internet unless there is a documented need plus MFA or an IP allow list | A4.9 to A4.11 |
Its firmware counts as an operating system, so it must be supported (A6.1) and patched within 14 days for critical and high-risk fixes (A6.4). For cloud services the same job is done by data flow policies.
Where the boundary sits for home workers
Home routers you did not supply are out of scope, so a home worker's laptop relies on its own software firewall. If they connect through a corporate VPN, the requirements put their internet boundary on the company firewall instead.
Common mistakes
- A router model the maker no longer updates.
- Old port forwards from a previous IT supplier with no record of why they exist.
See the firewall requirements and A4.1. Related: firewall rule, admin interface, firmware.
Related terms
- Software firewallA software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
- Corporate VPNA corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply.
- Firewall ruleA firewall rule is a single instruction on a firewall that says which traffic to allow or block, based on where it comes from, where it is going and what type it is.
- Admin interfaceAn admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.
- FirmwareFirmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
Frequently asked questions
A boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, boundary firewall comes up at A2.5, A4.1, A4.2, A4.3, A4.6, A4.7, A4.8, A4.9. Read those questions against the definition above so your answers use the term the way the assessor will.
Boundary firewall relates to 1. Firewalls in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.