Firewall rule
A firewall rule is a single instruction on a firewall that says which traffic to allow or block, based on where it comes from, where it is going and what type it is. Cyber Essentials requires inbound rules to be approved and documented by an authorised person with the business need (A4.8), and unused rules to be removed (A4.6).
- Term
- Firewall rule
- Also known as
- Firewall policy, Access rule, ACL
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls
- Reviewed against
- Requirements v3.3
What does the term firewall rule mean in Cyber Essentials?
A firewall rule is a single instruction on a firewall that says which traffic to allow or block, based on where it comes from, where it is going and what type it is.
It can help protect against cyber attacks by implementing restrictions, known as ‘firewall rules,’ which can allow or block traffic depending on its source, destination and type of communication protocol.
How does firewall rule apply to Cyber Essentials?
In plain terms
If the firewall is the receptionist, the rules are the visitor list at the desk. Each line says who may come in, which room they may visit, and by which door. A typical rule reads something like: allow secure web traffic from anywhere to the booking server. Anything not on the list is turned away.
What Cyber Essentials asks
The firewall requirements set three duties for rules on every firewall:
- "block unauthenticated inbound connections by default"
- "ensure inbound firewall rules are approved and documented by an authorised person, and include the business need in the documentation"
- "remove or disable unnecessary firewall rules, when they are no longer needed"
The 2026 question set tests these at A4.5 (do you have a process to manage your firewall), A4.6 (have you reviewed your rules in the last 12 months, and how) and A4.8 (how you approve and document allowed inbound connections). The guidance to A4.8 says the business case "must be signed off at board level and associated risks reviewed regularly".
What an assessor looks for
- A written record for each inbound rule: what it allows, why, who approved it and when.
- A review process that names who reviews the rules, how often, and who checks removals happen, as the A4.6 guidance describes.
- Old rules left behind by a previous IT supplier. These are the ones that tend to turn up in the external vulnerability scan for Cyber Essentials Plus.
See the firewall requirements and A4.8. Related: inbound connection, port forwarding.
Related terms
- External vulnerability scanAn external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.
- Inbound connectionAn inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start.
- Port forwardingPort forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.
- Guest Wi-FiGuest Wi-Fi is a separate wireless network for visitors that lets them reach the internet without joining the network your staff and business systems use.
- Internet service provider (ISP)An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it.
- Internet-facingInternet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
Frequently asked questions
A firewall rule is a single instruction on a firewall that says which traffic to allow or block, based on where it comes from, where it is going and what type it is. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, firewall rule comes up at A4.5, A4.6, A4.8. Read those questions against the definition above so your answers use the term the way the assessor will.
Firewall rule relates to 1. Firewalls in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.