VLAN (virtual local area network)
A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it. In Cyber Essentials a VLAN or a firewall is the only accepted way to create a sub-set, which is how part of a network is excluded from scope (A2.2.2).
- Term
- VLAN
- Also known as
- Virtual local area network, Virtual LAN
- Category
- Networks and firewalls
- Requirement area
- B. Definitions; D. Scope
- Reviewed against
- Requirements v3.3
What does the term VLAN mean in Cyber Essentials?
A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.
A sub-set is part of the organisation whose network is segregated from the rest of the organisation by a firewall or VLAN
How does VLAN apply to Cyber Essentials?
In plain terms
Imagine one open-plan office where you put up soundproof partitions. Everyone still shares the same building and cabling, but people in one area cannot hear the next. A VLAN does this with network switches: the finance team, the guest wifi and the test lab can share the same kit while being kept apart.
What Cyber Essentials asks
VLANs matter when you want to leave part of your network out of scope. The definition of a sub-set, quoted above, names only two ways of doing it: a firewall or a VLAN. The guidance to A2.2.2 is blunt: "Sub-sets must be created using a firewall or VLAN - other methods such as security groups, microsegmentation or software-based methods are not compliant." It gives the example "Finance department - VLAN".
This ties to several questions:
- A2.1: whole or partial organisation. Excluding networks means partial.
- A2.2.1 and A2.2.2: describe the excluded networks and how they are separated.
- A6.7: unsupported software you cannot remove must go on "its own sub-set with no internet access".
The scope guidance in the question set also says development, testing and penetration testing networks "must be kept separate from the rest of your IT systems using a firewall or VLAN".
Common mistakes
- Relying on shared folder permissions or security groups and calling it a separate network.
- Excluding a sub-set that can still reach the internet and then claiming whole organisation. The A6.7 guidance says that forces "Partial Organisation" in A2.1.
See what is in scope and A2.2.2. Related: network segregation, sub-set.
Related terms
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- Network segregationNetwork segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.
- VPN (virtual private network)A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.
- WPA2 and WPA3WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two.
- Admin interfaceAn admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.
- Boundary firewallA boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
Frequently asked questions
A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, VLAN comes up at A2.1, A2.2.1, A2.2.2, A6.7. Read those questions against the definition above so your answers use the term the way the assessor will.
VLAN relates to B. Definitions; D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.