Check your readiness
Section A4 · Danzell 2026

Cyber Essentials A4 questions: firewalls

The A4 questions test control 1: boundary and software firewalls, default passwords, admin interface exposure, inbound rules and rule reviews.

Updated 22 September 2026
Short answer

Section A4 tests the firewall control. It asks whether every device sits behind a firewall, whether software firewalls are on, whether default passwords were changed and how the admin password is protected, whether the admin interface is reachable from the internet, and how inbound rules are approved, documented and reviewed.

Key facts
Questions
14 (A4.1 to A4.11)
Auto-fails
None
CE Plus test
Test 1: external vulnerability scan

What questions are in section A4?

Section A4 has 14 questions, A4.1 to A4.11, none of them automatic fails. Each page gives the exact wording, what a compliant answer looks like and a model answer.

  1. A4.1Yes/NoDo you have firewalls at the boundaries between your organisation’s internal networks, laptops, desktops, servers and the internet?
  2. A4.1.1Yes/NoDo you have software firewalls enabled on all of your computers, laptops and servers?
  3. A4.1.2NotesIf you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems.Conditional: only show if no to A4.1.1
  4. A4.2Yes/NoWhen you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?
  5. A4.2.1NotesPlease describe the process for changing your firewall password.
  6. A4.3Options A to EHow is your firewall password configured?
  7. A4.4Yes/NoDo you change your firewall password when you know or suspect it has been compromised?
  8. A4.5Yes/NoDo you have a process to manage your firewall?
  9. A4.6NotesHave you reviewed your firewall rules in the last 12 months?
  10. A4.7Yes/NoIs your firewall configured to allow unauthenticated inbound connections?
  11. A4.8NotesPlease describe how you approve and document your allowed inbound connections.
  12. A4.9Yes/NoAre your boundary firewalls configured to allow access to their configuration settings over the internet?
  13. A4.10Yes/NoIf you answered yes in question A4.9, is there a documented business requirement for this access?Conditional: if yes to question A4.9
  14. A4.11NotesIf you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentica…Conditional: if yes to question A4.9

How do assessors mark section A4?

Assessors read section A4 as a whole and against the scope inventory in A2: every answer must be true across the whole scope and consistent with the rest of the submission.

What they look for
For the notes questions (A4.2.1, A4.6, A4.8, A4.11) the assessor is looking for a process with an owner, a trigger and a record. 'We change it when we set it up' passes A4.2.1; 'the firewall is managed by our MSP' on its own does not, because the scheme needs you to confirm the control is met on your behalf. For A4.3 the option must match the password rules exactly: 8 characters with MFA, 12 characters, or 8 with a deny list.
Common failure: The MSP-managed firewall nobody can describe
An applicant answers Yes to A4.5 and writes 'managed by our IT provider' for A4.6 and A4.8. The assessor returns the question because there is no description of the review or the approval process. Fix: ask the provider for their change process and the date of the last rule review, and write both into the notes in your own words.

Related requirements

Frequently asked questions

14, from A4.1 to A4.11. 3 of them are conditional and only appear depending on an earlier answer.

No. None of the A4 questions is an auto-fail, but unclear or contradictory answers are returned by the assessor for more information.

8 Yes/No, 5 notes and 1 multiple choice questions.

Yes. The NCSC says most desktop and laptop operating systems now come with a software firewall pre-installed and advises turning that on in preference to a third-party firewall application. Windows Defender Firewall, the macOS application firewall and a Linux host firewall all satisfy A4.1.1 as long as they are enabled on every device.

No, unless your organisation supplied the router. Routers you did not supply are out of scope, which is why the scheme requires firewall controls such as a software firewall on the user's device instead. If a home worker uses a corporate VPN, their internet boundary moves to the company firewall or virtual or cloud firewall.

Options A, B, C and D pass: MFA with a minimum password length of 8 characters and no maximum; automatic blocking of common passwords with a minimum of 8 characters; a minimum length of 12 characters; or a passwordless system that you describe. Option E, none of the above, means the requirement is not met.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources