WPA2 and WPA3
WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two. Cyber Essentials does not assess Wi-Fi encryption, because the scheme is not concerned with attacks that can only be launched within the signal range of a wireless device.
- Term
- WPA2 and WPA3
- Also known as
- Wi-Fi Protected Access, WPA2, WPA3, Wi-Fi encryption
- Category
- Networks and firewalls
- Requirement area
- D(iii) Wireless devices
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term WPA2 and WPA3 mean in Cyber Essentials?
WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two.
How does WPA2 and WPA3 apply to Cyber Essentials?
In plain terms
When a laptop talks to a Wi-Fi access point, the conversation travels through the air. Anyone nearby with the right equipment can pick it up. WPA2 and WPA3 scramble that conversation so it cannot be read, and they decide who may join, usually with a Wi-Fi password or a work login.
You pick the setting in your router or access point. WPA3 is the current standard. WPA2 is older and still widespread. Older options such as WEP and the original WPA are outdated and should be switched off.
What Cyber Essentials asks
Nothing directly. The wireless devices section of the scope says wireless kit is "out of scope if it's not possible for an attacker to attack directly via the internet (the Cyber Essentials scheme isn't concerned with attacks that can only be launched within the signal range of the wireless device)". The 2026 question set has no question on Wi-Fi encryption.
The scheme does care about the equipment behind the Wi-Fi. Access points that "can communicate with other devices via the internet" are in scope. A router or firewall that routes internet traffic is listed at A2.5, must have its default admin password changed (A4.2), and must run supported firmware (A6.1).
Common mistakes
- Assuming a strong Wi-Fi password covers the router. The Wi-Fi password and the router's admin password are separate, and only the admin password is assessed.
- Assuming Wi-Fi encryption protects staff on public hotspots. It does not. The requirements say to use a software firewall "on devices which are used on untrusted networks, such as public wifi hotspots".
See wireless devices in scope. Related: guest Wi-Fi, router, software firewall.
Related terms
- Guest Wi-FiGuest Wi-Fi is a separate wireless network for visitors that lets them reach the internet without joining the network your staff and business systems use.
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.
- Software firewallA software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
- Admin interfaceAn admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.
- Boundary firewallA boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
- Corporate VPNA corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply.
Frequently asked questions
WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two.
WPA2 and WPA3 relates to D(iii) Wireless devices in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.