Remote Desktop Protocol (RDP)
Remote Desktop Protocol (RDP) is Microsoft's way of letting someone see and control a Windows computer or server from another device over a network. Cyber Essentials does not name RDP, but opening it to the internet is an inbound firewall rule: it needs a documented business need (A4.8), and unauthenticated inbound connections must stay blocked (A4.7).
- Term
- Remote Desktop Protocol
- Also known as
- RDP, Remote desktop, Remote Desktop Services
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls; 2. Secure Configuration
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term Remote Desktop Protocol mean in Cyber Essentials?
Remote Desktop Protocol (RDP) is Microsoft's way of letting someone see and control a Windows computer or server from another device over a network.
How does Remote Desktop Protocol apply to Cyber Essentials?
In plain terms
Remote desktop lets you sit at home and use your office PC as if you were at your desk: you see its screen and use its keyboard and mouse from afar. IT suppliers use it to fix servers, and some small firms use it so staff can reach an office computer from home.
The risk is how it is reached. If the office router forwards the remote desktop port straight to a PC, anyone on the internet can find the login screen and start guessing passwords.
What Cyber Essentials asks
The 2026 question set does not mention RDP by name, so the general rules apply:
- The firewall must "block unauthenticated inbound connections by default" (A4.7).
- Any inbound rule that lets remote desktop in must be "approved and documented by an authorised person" with the business need (A4.8), and removed when no longer needed (A4.6).
- If the service gives internet users access to data that should not be public, A5.4 to A5.7 ask which authentication option protects it and how brute-force guessing is stopped.
- If you do not need remote desktop at all, secure configuration asks you to "remove or disable unnecessary software (including applications, system utilities and network services)" (A5.1).
For Cyber Essentials Plus, test case 1 scans your public addresses and judges every internet-accessible service it finds, so an open remote desktop port will be looked at.
Common mistakes
- Exposing remote desktop directly rather than putting it behind a VPN.
- Remote desktop turned on for every PC by default when only the IT supplier uses it.
- A port forwarding rule for remote desktop that no one can explain.
See the firewall requirements and A4.7. Related: SSH, inbound connection.
Related terms
- Port (network port)A port is a numbered doorway on a device that a particular kind of network traffic uses, for example secure web pages usually arrive on port 443.
- VPN (virtual private network)A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.
- Port forwardingPort forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.
- SSH (Secure Shell)SSH, or Secure Shell, is an encrypted way for IT staff to log in to a server, firewall or other network device from another computer and type commands to manage it.
- Inbound connectionAn inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start.
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.
Frequently asked questions
Remote Desktop Protocol (RDP) is Microsoft's way of letting someone see and control a Windows computer or server from another device over a network.
Remote Desktop Protocol relates to 1. Firewalls; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.