Default password
A default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own. Cyber Essentials requires every default password to be changed: on routers and firewalls at A4.2, including unique pre-set ones, and on computers, servers and phones at A5.3.
- Term
- Default password
- Also known as
- Factory password, Pre-set password, Out-of-the-box password
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term default password mean in Cyber Essentials?
A default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
an administrative account with a pre-set, publicly known default password or without multi-factor authentication enabled
How does default password apply to Cyber Essentials?
In plain terms
A default password is like the combination on a new padlock still set to 0000. Many products used to ship with the same password on every unit, such as "admin", and those lists are easy to find online. Newer routers often print a unique password on a sticker. That is better, but it is still one you did not choose, and anyone who has seen the sticker knows it.
What Cyber Essentials asks
The secure configuration section lists a pre-set, publicly known default password as one of the weak points of out-of-the-box devices, in the words quoted above. The control that follows is to "change any default or guessable account passwords".
The question set asks about it twice:
- A4.2 for routers and firewalls. The guidance says the password "must be changed on all routers and firewalls, including those that come with a unique password pre-configured (e.g. BT Business Hub, Draytek Vigor 2865ac)". A4.2.1 asks you to describe how you change it.
- A5.3 for "all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones".
The firewall requirement allows one alternative: change the password "to a strong and unique password ... or disable remote administrative access entirely". The new password must meet the password-based authentication rules, which A4.3 checks.
Common mistakes
- Keeping the sticker password on the office router.
- Changing the Wi-Fi password but not the router's admin password. They are different.
- Forgetting other kit with admin logins, such as printers, NAS boxes and CCTV recorders.
See the firewall requirements, A4.2 and A5.3. Related: router, admin interface.
Related terms
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.
- Admin interfaceAn admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.
- DMZ (demilitarised zone)A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach.
- DNS (Domain Name System)DNS, the Domain Name System, is the internet's address book that turns names people can read, such as example.co.uk, into the number addresses computers use.
- External vulnerability scanAn external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.
- FirewallA firewall is a device or piece of software that sits between your computers and the internet and decides, using a set of rules, which traffic is allowed through.
Frequently asked questions
A default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, default password comes up at A4.2, A4.2.1, A5.3. Read those questions against the definition above so your answers use the term the way the assessor will.
Default password relates to 1. Firewalls; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.