Router
A router is the box that connects your office or home network to the internet and passes traffic between the two. Most business routers include a firewall, so for Cyber Essentials the router is often your boundary firewall. It is listed at A2.5, its default password must be changed (A4.2), and its firmware must be supported (A6.1).
- Term
- Router
- Also known as
- Broadband router, Internet router, Hub
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls; D(ii) Home and remote working
- Reviewed against
- Requirements v3.3
What does the term router mean in Cyber Essentials?
A router is the box that connects your office or home network to the internet and passes traffic between the two.
If your organisation gives the home/remote worker a router, that router is then also in scope. All other routers are out of scope which means you need to apply Cyber Essentials firewall controls (such as a software firewall) on user devices.
How does router apply to Cyber Essentials?
In plain terms
A router is like the post room for your building. Everything that comes in from the internet or goes out to it passes through this one box, which sends each item to the right desk. The box your broadband provider sent you, such as a BT Business Hub, is a router.
What Cyber Essentials asks
A2.5 asks you to list the make, model and quantity of every router and firewall that controls the flow of data to and from the internet. Where the router has firewall functionality, it must meet every firewall rule: change the default admin password (A4.2), block unauthenticated inbound connections (A4.7), and keep its settings off the internet unless the conditions in A4.9 to A4.11 are met.
A4.2 is specific: the default password must be changed "including those that come with a unique password pre-configured (e.g. BT Business Hub, Draytek Vigor 2865ac)". A6.1 adds that router firmware "is considered to be an operating system", so it must still receive security updates from the vendor.
Home routers are handled differently. A router you give to a home worker is in scope. A router the worker got from their own broadband provider is out of scope, and must not be listed at A2.5.
Common mistakes
- Leaving the password printed on the sticker in place. A pre-set unique password still counts as a default.
- Running a router the manufacturer no longer updates. Check the vendor's end-of-life list before you apply.
- Listing staff home routers at A2.5 instead of relying on software firewalls.
See the firewall requirements, home and remote working and the DrayTek and UniFi setup guides. Related: default password, internet service provider.
Related terms
- Software firewallA software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
- Internet service provider (ISP)An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it.
- SSH (Secure Shell)SSH, or Secure Shell, is an encrypted way for IT staff to log in to a server, firewall or other network device from another computer and type commands to manage it.
- Static IP addressA static IP address is a public internet address that stays the same over time, unlike a dynamic address that your broadband provider can change without notice.
- VLAN (virtual local area network)A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.
Frequently asked questions
A router is the box that connects your office or home network to the internet and passes traffic between the two. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, router comes up at A2.5, A4.2, A4.2.1, A6.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Router relates to 1. Firewalls; D(ii) Home and remote working in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.