Inbound connection
An inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start. Cyber Essentials requires firewalls to block unauthenticated inbound connections by default (A4.7) and each allowed inbound connection to be approved and documented with its business need (A4.8).
- Term
- Inbound connection
- Also known as
- Incoming connection, Inbound traffic
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls
- Reviewed against
- Requirements v3.3
What does the term inbound connection mean in Cyber Essentials?
An inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start.
block unauthenticated inbound connections by default
How does inbound connection apply to Cyber Essentials?
In plain terms
When you open a website, your laptop makes the call: that is an outbound connection. An inbound connection is the reverse, a stranger on the internet knocking on your door first. Some of these are wanted, such as customers reaching a web shop you host in the office. Most are not. Automated tools scan the internet all day looking for doors that open.
"Unauthenticated" means the door opens without asking for a login first.
What Cyber Essentials asks
A4.7 asks: "Is your firewall configured to allow unauthenticated inbound connections?" The guidance notes that "most firewalls block all services inside the network from being accessed from the internet, but you need to check your firewall settings." The expected answer for a compliant firewall is No.
Where you do need to let something in, for example "a VPN server, a mail server, an FTP server, or a service that is accessed by your customers", A4.8 asks how you approve and document it. The guidance says the business case should be recorded and "signed off at board level".
The scope section also uses the idea: the requirements apply to devices that "can accept incoming network connections from internet-connected devices".
Common mistakes
- Assuming the router's factory settings are fine without checking them, which is what the A4.7 guidance warns about.
- Rules added for a one-off job that were never removed.
- A service that asks for a login still needs a documented firewall rule and business case.
See the firewall requirements and A4.7. Related: outbound connection, port forwarding.
Related terms
- Firewall ruleA firewall rule is a single instruction on a firewall that says which traffic to allow or block, based on where it comes from, where it is going and what type it is.
- Outbound connectionAn outbound connection is a connection that one of your own devices starts towards something on the internet, such as a laptop opening a website.
- Port forwardingPort forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.
- Internet service provider (ISP)An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it.
- Internet-facingInternet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
- IP addressAn IP address is the number that identifies a device or internet connection on a network, so that traffic can be delivered to the right place.
Frequently asked questions
An inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, inbound connection comes up at A4.7, A4.8. Read those questions against the definition above so your answers use the term the way the assessor will.
Inbound connection relates to 1. Firewalls in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.