DMZ (demilitarised zone)
A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach. The Cyber Essentials requirements do not use the term. Servers in a DMZ still accept connections from the internet, so they are in scope and their inbound rules need approval (A4.8).
- Term
- DMZ
- Also known as
- Demilitarised zone, Perimeter network, Screened subnet
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls; D. Scope
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term DMZ mean in Cyber Essentials?
A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach.
How does DMZ apply to Cyber Essentials?
In plain terms
Think of a reception area that visitors can walk into without a pass, with a locked door between it and the main office. You meet customers there, and even if a visitor misbehaves they cannot wander into the back office. A DMZ is that reception area for servers: a web server or mail server sits there, reachable from the internet, while a firewall keeps it apart from staff laptops and file shares.
What Cyber Essentials asks
Neither the requirements nor the 2026 question set mention a DMZ. What matters is how the servers in it are treated. The requirements apply to devices that "can accept incoming network connections from internet-connected devices", so a DMZ server is in scope. It needs the full set of controls: supported and patched software, secure configuration, user access control and malware protection.
The firewall rules that let internet traffic into the DMZ are inbound rules. Each one must be "approved and documented by an authorised person" with the business need, as A4.8 asks, and removed when no longer needed (A4.6). If the server gives access to data that should not be public, A5.4 to A5.7 cover how users log in.
A DMZ is not the same as a sub-set excluded from scope. A sub-set is left out of the assessment, while a DMZ holds servers that face the internet and so are exactly what the scheme is designed to protect.
Common mistakes
- Treating DMZ servers as out of scope because they are "outside" the main network.
- Broad rules that let the DMZ reach the internal network freely, which defeats the point of the zone.
See the firewall requirements and what is in scope. Related: internet-facing, network segregation.
Related terms
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- Internet-facingInternet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
- Network segregationNetwork segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.
- DNS (Domain Name System)DNS, the Domain Name System, is the internet's address book that turns names people can read, such as example.co.uk, into the number addresses computers use.
- External vulnerability scanAn external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.
- FirewallA firewall is a device or piece of software that sits between your computers and the internet and decides, using a set of rules, which traffic is allowed through.
Frequently asked questions
A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach.
DMZ relates to 1. Firewalls; D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.