Internet service provider (ISP)
An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it. For Cyber Essentials, an ISP router in your office is in scope and its default password must be changed (A4.2). An ISP router in a home worker's house is out of scope.
- Term
- Internet service provider
- Also known as
- ISP, Broadband provider
- Category
- Networks and firewalls
- Requirement area
- D(ii) Home and remote working; D(iii) Wireless devices
- Reviewed against
- Requirements v3.3
What does the term internet service provider mean in Cyber Essentials?
An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it.
How does internet service provider apply to Cyber Essentials?
In plain terms
Your ISP is the company you pay for broadband or a leased line. It gives you a connection, a public IP address, and usually a router to plug in. Because the router arrives ready to go, it is easy to forget that your organisation is responsible for how it is set up.
What Cyber Essentials asks
At your office, the ISP router is treated like any other router. If it controls the flow of data to and from the internet, list it at A2.5 and apply the firewall control. A4.2 is explicit that the default admin password must be changed "including those that come with a unique password pre-configured (e.g. BT Business Hub, Draytek Vigor 2865ac)".
At home it is different. The requirements say "If your organisation gives the home/remote worker a router, that router is then also in scope. All other routers are out of scope". A4.2.1 confirms "Home routers not supplied by your organisation are not included in this requirement", and A2.5 says home routers "must not be included". The wireless devices section adds that Wi-Fi which is "part of an ISP router at the home or remote location" is out of scope. The worker's laptop then needs its own software firewall.
Common mistakes
- Assuming the ISP manages the router's security. If you cannot change its admin password or firmware yourself, check with the ISP before you apply.
- Listing staff home broadband routers at A2.5.
- Not knowing your public addresses when booking Cyber Essentials Plus. Your ISP can confirm them.
See home and remote working and A4.2. Related: router, default password.
Related terms
- IP addressAn IP address is the number that identifies a device or internet connection on a network, so that traffic can be delivered to the right place.
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.
- Software firewallA software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
- Internet-facingInternet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
- NAT (network address translation)NAT, network address translation, is the way a router lets many devices on your network share one public internet address by swapping addresses as traffic passes through.
Frequently asked questions
An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it.
In the 2026 Danzell question set, internet service provider comes up at A4.2, A4.2.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Internet service provider relates to D(ii) Home and remote working; D(iii) Wireless devices in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.