VPN (virtual private network)
A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there. In Cyber Essentials only a corporate VPN you administer counts. A home worker using one has their internet boundary at the company firewall. Remote access is asked at A2.4.2.
- Term
- VPN
- Also known as
- Virtual private network, Remote access VPN, Site-to-site VPN
- Category
- Networks and firewalls
- Requirement area
- B. Definitions; D(ii) Home and remote working
- Reviewed against
- Requirements v3.3
What does the term VPN mean in Cyber Essentials?
A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.
How does VPN apply to Cyber Essentials?
In plain terms
A VPN is like a private tunnel through a busy public road. Traffic still travels over the internet, but it is sealed so nobody along the way can read it, and it comes out inside your office network. Staff use it to reach office systems from home. Two offices can also be joined by one.
Consumer VPN apps sold for privacy or streaming work differently: they send your traffic to the provider's network, not to your organisation's.
What Cyber Essentials asks
The requirements define a corporate VPN as one "that connects back to your office location, or to a virtual or cloud firewall. You must administer the VPN so that you can apply the firewall controls." Section D(ii) adds: "If the home/remote worker is using a corporate VPN, their internet boundary is on the company firewall or virtual/cloud firewall."
VPNs come up in three questions:
- A2.4.2 asks how home and remote workers connect, for example "via home router, business-provided router or corporate VPN".
- A4.9 says that if firewall settings "are only accessible via a VPN connection", you can answer No to internet access.
- A5.4 lists "a VPN server" as an example of an external service, so the login to it must meet the authentication rules in A5.5 to A5.7.
Common mistakes
- Counting a consumer VPN as a corporate VPN.
- Turning off the laptop's software firewall because a VPN is used. The requirements still want a software firewall on devices used on untrusted networks.
- Old VPN appliance firmware. It faces the internet and is scanned in Cyber Essentials Plus test case 1.
See home and remote working and A2.4.2. Related: corporate VPN, software firewall.
Related terms
- Corporate VPNA corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply.
- Software firewallA software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
- WPA2 and WPA3WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two.
- Admin interfaceAn admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.
- Boundary firewallA boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
Frequently asked questions
A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.
In the 2026 Danzell question set, VPN comes up at A2.4.2, A4.9, A5.4. Read those questions against the definition above so your answers use the term the way the assessor will.
VPN relates to B. Definitions; D(ii) Home and remote working in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.