Firmware
Firmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work. For Cyber Essentials, router and firewall firmware counts as an operating system: it must be supported by the vendor (A6.1) and its critical and high-risk updates installed within 14 days (A6.4, an automatic fail if answered No).
- Term
- Firmware
- Also known as
- Router firmware, Firewall firmware
- Category
- Devices and software
- Requirement area
- B. Definitions; 3. Security Update Management
- Questions
- A2.5A6.1A6.4AUTO-FAILA6.4.2
- Reviewed against
- Requirements v3.3
What does the term firmware mean in Cyber Essentials?
Firmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.
How does firmware apply to Cyber Essentials?
In plain terms
The router your broadband provider sent and the firewall box in the comms cupboard both have software inside them. You rarely see it, and nobody logs into these boxes day to day, so it is easy to forget. That hidden software is firmware. The maker releases updates for it just as Apple does for an iPhone, but someone usually has to apply them.
What Cyber Essentials asks
The NCSC definition of software includes "firewall and router firmware", so it falls under the security update management control. The question set is explicit. A6.1 says "the firmware of these devices is considered to be an operating system and needs to meet this requirement". A6.4 says the 14-day rule "includes the firmware on your firewalls and routers". A6.4.2 asks how you make sure those updates go on within 14 days where automatic updates are not used. A2.5 asks for the make, model and quantity of each router and firewall, which lets the assessor check that the model is still supported.
Common mistakes
- Running a firewall or router model the maker no longer updates. It has to be replaced, or the requirement is not met.
- Having no named person or routine for checking firmware releases. Describe the routine in A6.4.2.
- Listing staff home routers. The A2.5 guidance says details of routers and firewalls in the home environment must not be included.
See the security update management requirements and the DrayTek setup guide. Related: boundary firewall, router, operating system.
Related terms
- Boundary firewallA boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.
- Operating system (OS)An operating system is the core software that runs a device and lets every other program work, such as Windows, macOS, iOS or Android.
- HypervisorA hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
- Jailbreaking and rootingJailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files.
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
Frequently asked questions
Firmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.
In the 2026 Danzell question set, firmware comes up at A2.5, A6.1, A6.4, A6.4.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Firmware relates to B. Definitions; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.