SSH (Secure Shell)
SSH, or Secure Shell, is an encrypted way for IT staff to log in to a server, firewall or other network device from another computer and type commands to manage it. Cyber Essentials does not name SSH. Reachable from the internet, it is an inbound service needing a documented business need (A4.8) and strong login protection.
- Term
- SSH
- Also known as
- Secure Shell, SSH key
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls; 4. User Access Control
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term SSH mean in Cyber Essentials?
SSH, or Secure Shell, is an encrypted way for IT staff to log in to a server, firewall or other network device from another computer and type commands to manage it.
How does SSH apply to Cyber Essentials?
In plain terms
SSH is a secure remote control for machines that have no screen to look at, such as Linux servers, firewalls and switches. An IT person opens a text window, connects, and types instructions. The connection is encrypted, so no one in between can read it. Instead of a password, SSH can use a key file held on the IT person's computer.
What Cyber Essentials asks
The scheme does not mention SSH, so it falls under the general rules.
- If SSH on a server or firewall can be reached from the internet, that is an inbound rule. It must be approved and documented with the business need (A4.8) and removed when not needed (A4.6).
- If SSH is how you manage the firewall itself, it is part of the "administrative interface (used to manage firewall configuration)". Internet access needs a documented business need and either MFA or an IP allow list with properly managed passwords (A4.9 to A4.11).
- Default passwords on devices that offer SSH must be changed (A4.2 for firewalls, A5.3 for other devices).
- Administrative accounts used over SSH fall under user access control, including separate admin accounts and the password-based authentication rules.
What an assessor looks for
- Whether SSH is exposed to the whole internet or only to trusted addresses or a VPN.
- Up-to-date SSH software. Cyber Essentials Plus test case 1 scans internet-facing services, and under the specification's flow diagram any service with a vulnerability scored 7.0 or more fails, however recently the fix was released.
See the firewall requirements and A4.9. Related: admin interface, remote desktop protocol.
Related terms
- VPN (virtual private network)A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.
- Admin interfaceAn admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.
- Remote Desktop Protocol (RDP)Remote Desktop Protocol (RDP) is Microsoft's way of letting someone see and control a Windows computer or server from another device over a network.
- Static IP addressA static IP address is a public internet address that stays the same over time, unlike a dynamic address that your broadband provider can change without notice.
- VLAN (virtual local area network)A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.
- WPA2 and WPA3WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two.
Frequently asked questions
SSH, or Secure Shell, is an encrypted way for IT staff to log in to a server, firewall or other network device from another computer and type commands to manage it.
SSH relates to 1. Firewalls; 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.