Sandboxing
Sandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data. Sandboxing is not a malware protection option in Cyber Essentials v3.3. The requirements list only two options: anti-malware software and application allow listing. A8.1 asks which one each device uses.
- Term
- Sandboxing
- Also known as
- Sandbox, Application sandboxing
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- A8.1
- Reviewed against
- Requirements v3.3
What does the term sandboxing mean in Cyber Essentials?
Sandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.
How does sandboxing apply to Cyber Essentials?
In plain terms
Think of a sandpit in a playground. Children can dig and build as they like, but the sand stays inside the frame. A sandbox on a computer does the same for software: an app or a suspicious file runs in its own walled area and cannot touch other apps, system files or documents outside it. Phones and tablets use this approach for their apps, and web browsers use it for web pages.
What Cyber Essentials asks
The v3.3 requirements do not mention sandboxing. The malware protection section says "For each device, you must use at least one of the options listed below", and it lists two: anti-malware software, an "option for in scope devices running Windows or MacOS including servers, desktop computers, laptops", and application allow listing, an "option for all in scope devices". Sandboxing does not appear in the v3.3 requirements, the Danzell question set or the Cyber Essentials Plus test specification v3.2.
A8.1 offers option A (anti-malware software), option B (application allow listing) and option C, "None of the above, please describe". A device protected only by sandboxing does not meet either listed option.
What to do instead
- Keep the sandboxing your platform provides. It is good practice, but it is not an answer to A8.1.
- For phones and tablets, use application allow listing: apps only from the official store, an approved list, and no unsigned apps (A8.4, A8.5).
- For Windows and macOS, use anti-malware software.
See the malware protection requirements and A8.1. Related: application control.
Related terms
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
- Application controlApplication control is a setting or tool that decides which programs are allowed to run on a device and blocks everything else.
- Security operations centre (SOC)A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.
- Shared responsibility modelA shared responsibility model is a cloud provider's written explanation of which security tasks it handles and which ones remain the customer's job.
- Signature-based detectionSignature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.
Frequently asked questions
Sandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.
In the 2026 Danzell question set, sandboxing comes up at A8.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.