Software firewall
A software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured. Cyber Essentials v3.3 requires one wherever you do not control the network a device uses, such as home broadband or public wifi. A4.1.1 checks they are on for all computers, laptops and servers.
- Term
- Software firewall
- Also known as
- Host-based firewall, Personal firewall
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls; D(ii) Home and remote working
- Reviewed against
- Requirements v3.3
What does the term software firewall mean in Cyber Essentials?
A software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
if your organisation doesn't control the network to which a device connects, you must configure a software firewall on the device. This works in the same way as a boundary firewall but only protects the single device on which it’s configured. This approach allows for more tailored rules and means that the rules apply to the device wherever it's used.
How does software firewall apply to Cyber Essentials?
In plain terms
A boundary firewall guards the front door of the office. A software firewall is a lock on each laptop's own door, so the laptop stays protected in a hotel, a coffee shop or a spare bedroom where the office firewall is nowhere near. Microsoft Defender Firewall on Windows and the built-in firewall on macOS are software firewalls.
What does Cyber Essentials require?
The firewalls section of the requirements sets the rule quoted above, and adds: "Most desktop and laptop operating systems now come with a software firewall pre-installed, we advise that these are turned on in preference to a third-party firewall application", and "Make sure you use a software firewall on devices which are used on untrusted networks, such as public wifi hotspots."
For remote workers the software firewall is the only firewall the scheme can rely on, because home routers not supplied by the organisation are out of scope. The question set goes further than the requirements text:
- A4.1.1 asks whether software firewalls are enabled on all computers, laptops and servers. The guidance says the firewall "needs to be configured and enabled at all times, even when sitting behind a physical/virtual boundary firewall in an office location."
- A4.1.2 exists for the rare operating system that ships without one. The guidance says "all versions of Windows, macOS and all common Linux distributions such as Ubuntu do have software firewalls available", so those cannot be listed here.
Where is the setting?
| Platform | Where to check | Source |
|---|---|---|
| Windows 10 and 11 | Windows Security, then Firewall & network protection. Turn Microsoft Defender Firewall on for the Domain, Private and Public profiles. | Microsoft Support |
| macOS | Apple menu, System Settings, Network, then Firewall. Turn the Firewall switch on. | Apple Support |
On managed devices, set it centrally, for example with an Intune or Jamf policy, so users cannot switch it off.
What an assessor looks for
- The firewall on for every profile, not only the Domain or Private one. The Public profile is the one that protects a laptop on hotel wifi.
- A notes answer at A2.5 that says home and remote workers rely on software firewalls, as the A2.5 guidance asks.
Common mistakes
- Turning the firewall off on servers because they sit behind the office firewall. A4.1.1 covers servers too.
- Relying on a software firewall to define a partial scope. A2.5.1 says built-in firewalls such as Windows Firewall "cannot be used to define the boundary of the scope".
See the firewall requirements, home and remote working and the Windows 11 setup guide. Related: boundary firewall, router.
Related terms
- Boundary firewallA boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.
- SSH (Secure Shell)SSH, or Secure Shell, is an encrypted way for IT staff to log in to a server, firewall or other network device from another computer and type commands to manage it.
- Static IP addressA static IP address is a public internet address that stays the same over time, unlike a dynamic address that your broadband provider can change without notice.
- VLAN (virtual local area network)A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.
- VPN (virtual private network)A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.
Frequently asked questions
A software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, software firewall comes up at A4.1.1, A4.1.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Software firewall relates to 1. Firewalls; D(ii) Home and remote working in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.