Corporate VPN
A corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply. In Cyber Essentials a home worker on a corporate VPN has their internet boundary at the company firewall. A consumer privacy VPN does not meet the definition.
- Term
- Corporate VPN
- Also known as
- Company VPN, Virtual private network
- Category
- Networks and firewalls
- Requirement area
- B. Definitions; D(ii) Home and remote working
- Reviewed against
- Requirements v3.3
What does the term Corporate VPN mean in Cyber Essentials?
A corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply.
A corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall. You must administer the VPN so that you can apply the firewall controls.
How does Corporate VPN apply to Cyber Essentials?
In plain terms
A corporate VPN is a private tunnel from a laptop back to your own office or cloud firewall. Once connected, the laptop's internet traffic passes through a firewall your organisation controls, so the firewall rules you set apply even when the person is working from home.
What Cyber Essentials asks
The definition, quoted above, is from section B of the requirements. It matters for remote workers. The home and remote working section says home routers you did not supply are out of scope, "which means you need to apply Cyber Essentials firewall controls (such as a software firewall) on user devices." It then adds: "If the home/remote worker is using a corporate VPN, their internet boundary is on the company firewall or virtual/cloud firewall."
In the question set, A2.4.2 asks how home and remote workers connect, giving "corporate VPN" as one example. A4.1.1 still asks for software firewalls on all computers, laptops and servers, enabled "at all times".
Does your VPN count?
| VPN type | Corporate VPN? | Boundary for the home worker |
|---|---|---|
| Connects to your office or cloud firewall, administered by your organisation so the firewall controls apply | Yes | Your company firewall |
| Consumer privacy VPN app | No | The laptop's own software firewall |
Common mistakes
- Switching off the laptop firewall because the VPN is on. A4.1.1 and the requirement for software firewalls on "untrusted networks, such as public wifi hotspots" still apply.
- Exposing the VPN login page without MFA or brute-force protection. It is an internet-facing service under A5.4 to A5.7, and its firmware or software falls under the 14-day rule.
See home and remote working and the firewall requirements. Related: boundary firewall, software firewall, internet-facing.
Related terms
- Boundary firewallA boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
- Software firewallA software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
- Internet-facingInternet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
- DMZ (demilitarised zone)A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach.
- DNS (Domain Name System)DNS, the Domain Name System, is the internet's address book that turns names people can read, such as example.co.uk, into the number addresses computers use.
Frequently asked questions
A corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, Corporate VPN comes up at A2.4.2, A4.1.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Corporate VPN relates to B. Definitions; D(ii) Home and remote working in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.