Internet-facing
Internet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server. In Cyber Essentials such devices are in scope, need an approved inbound rule (A4.8), and must authenticate users before giving access to non-public data (A5.4).
- Term
- Internet-facing
- Also known as
- Public-facing, Externally exposed, Exposed service
- Category
- Networks and firewalls
- Requirement area
- D. Scope; 1. Firewalls; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term internet-facing mean in Cyber Essentials?
Internet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
can accept incoming network connections from internet-connected devices
How does internet-facing apply to Cyber Essentials?
In plain terms
An internet-facing service is like a shop window on a busy street. Anyone walking past can see it and try the door, including people scanning every door on the street at once. A laptop in the office behind a firewall is not internet-facing. The login page for your VPN, a web server in the office or the settings page of a router with remote management switched on all are.
What Cyber Essentials asks
The scope section, quoted above, brings any device that can accept incoming connections from the internet into scope. The firewall control then asks you to block unauthenticated inbound connections by default (A4.7) and to approve and document each allowed inbound connection with its business need (A4.8).
A5.4 asks: "Do you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?" The guidance gives examples: "a VPN server, a mail server, or an internally hosted internet application". If Yes, A5.5 asks which authentication option you use, A5.6 how you change passwords after a compromise, and A5.7 how you stop brute-force attempts when MFA is not used.
Internet-facing software must also be supported and patched within 14 days where fixes are critical or high risk.
What an assessor looks for
- A match between your approved inbound rules and what actually answers from the internet.
- Firewall admin pages and remote desktop left open by mistake.
For Cyber Essentials Plus this is tested directly: test case 1 scans every public address and records a pass or fail for "each Internet-accessible service" found.
See Test 1: the external vulnerability scan and A5.4. Related: inbound connection, external vulnerability scan.
Related terms
- Inbound connectionAn inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start.
- External vulnerability scanAn external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.
- IP addressAn IP address is the number that identifies a device or internet connection on a network, so that traffic can be delivered to the right place.
- NAT (network address translation)NAT, network address translation, is the way a router lets many devices on your network share one public internet address by swapping addresses as traffic passes through.
- Network segregationNetwork segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.
- Outbound connectionAn outbound connection is a connection that one of your own devices starts towards something on the internet, such as a laptop opening a website.
Frequently asked questions
Internet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, internet-facing comes up at A4.7, A4.8, A5.4. Read those questions against the definition above so your answers use the term the way the assessor will.
Internet-facing relates to D. Scope; 1. Firewalls; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.