Guest Wi-Fi
Guest Wi-Fi is a separate wireless network for visitors that lets them reach the internet without joining the network your staff and business systems use. Cyber Essentials does not assess Wi-Fi security itself, because it is not concerned with attacks launched within signal range. The router or firewall providing the guest network is still in scope.
- Term
- Guest Wi-Fi
- Also known as
- Guest wireless, Guest network, Visitor Wi-Fi
- Category
- Networks and firewalls
- Requirement area
- D(iii) Wireless devices
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term Guest Wi-Fi mean in Cyber Essentials?
Guest Wi-Fi is a separate wireless network for visitors that lets them reach the internet without joining the network your staff and business systems use.
How does Guest Wi-Fi apply to Cyber Essentials?
In plain terms
Guest Wi-Fi is like a waiting room with its own front door. Visitors, customers or contractors can get online, but they cannot walk into the back office where your files, printers and staff laptops are. Most business routers and wireless systems can offer one with a few settings.
What Cyber Essentials asks
The requirements do not mention guest Wi-Fi. The wireless devices section of the scope says wireless kit, including access points, is:
- "in scope if they can communicate with other devices via the internet"
- "out of scope if it's not possible for an attacker to attack directly via the internet (the Cyber Essentials scheme isn't concerned with attacks that can only be launched within the signal range of the wireless device)"
- "out of scope if they are part of an ISP router at the home or remote location"
So the guest Wi-Fi password and encryption are not assessed. What is assessed is the router or firewall providing the internet connection. It is listed at A2.5 and must meet the firewall control, including a changed default admin password (A4.2).
Keeping guests off the staff network is sensible practice rather than a scheme rule. If you separate them, a firewall or VLAN is the same method the scheme accepts for a sub-set.
Common mistakes
- Guest Wi-Fi that is really the staff network with a second name, giving visitors a route to your file shares.
- Staff using guest Wi-Fi on work laptops. Treat it as an untrusted network and keep the software firewall on.
See wireless devices in scope. Related: WPA2 and WPA3, network segregation.
Related terms
- VLAN (virtual local area network)A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- WPA2 and WPA3WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two.
- Network segregationNetwork segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.
- Inbound connectionAn inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start.
- Internet service provider (ISP)An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it.
Frequently asked questions
Guest Wi-Fi is a separate wireless network for visitors that lets them reach the internet without joining the network your staff and business systems use.
Guest Wi-Fi relates to D(iii) Wireless devices in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.