NAT (network address translation)
NAT, network address translation, is the way a router lets many devices on your network share one public internet address by swapping addresses as traffic passes through. The Cyber Essentials requirements do not mention NAT. What they require is a correctly configured firewall that blocks unauthenticated inbound connections, which A4.7 asks about.
- Term
- NAT
- Also known as
- Network address translation, Carrier-grade NAT, CGNAT
- Category
- Networks and firewalls
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term NAT mean in Cyber Essentials?
NAT, network address translation, is the way a router lets many devices on your network share one public internet address by swapping addresses as traffic passes through.
How does NAT apply to Cyber Essentials?
In plain terms
Think of an office with one main phone number and many extensions. Callers outside only ever see the main number, and the switchboard connects replies to the right desk. NAT does this for internet traffic. Your laptops and printers have private internal addresses, and the router shows the outside world a single public IP address.
A side effect is that strangers cannot easily reach a device inside unless someone sets up port forwarding.
What Cyber Essentials asks
The scheme does not use the term. The firewall control asks you to protect every in-scope device "with a correctly configured firewall (or network device with firewall functionality)" and to "block unauthenticated inbound connections by default". Do not rely on NAT alone to answer A4.1 or A4.7. Check the firewall settings on the router, as the A4.7 guidance advises.
NAT does appear once in the Cyber Essentials Plus test specification. For test case 1 the assessor must "take care with such addresses to ensure services like carrier-grade NAT do not inadvertently send assessment traffic to the wrong destination". Carrier-grade NAT is where your broadband provider shares one public address between several customers, which makes it harder to pin down which address is yours.
What an assessor looks for
- Port forwards and other NAT rules, which count as inbound firewall rules needing a documented business need (A4.8).
- An accurate list of your public addresses before the external scan, especially if your provider uses carrier-grade NAT.
See the firewall requirements and Test 1: the external vulnerability scan. Related: router, static IP address.
Related terms
- IP addressAn IP address is the number that identifies a device or internet connection on a network, so that traffic can be delivered to the right place.
- Port forwardingPort forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.
- Static IP addressA static IP address is a public internet address that stays the same over time, unlike a dynamic address that your broadband provider can change without notice.
- Network segregationNetwork segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.
- Outbound connectionAn outbound connection is a connection that one of your own devices starts towards something on the internet, such as a laptop opening a website.
Frequently asked questions
NAT, network address translation, is the way a router lets many devices on your network share one public internet address by swapping addresses as traffic passes through.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.