A4.1: Do you have firewalls between your networks, devices and the internet?
Do you have firewalls at the boundaries between your organisation’s internal networks, laptops, desktops, servers and the internet?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
To answer Yes to A4.1 every device in scope must be protected by a correctly configured firewall or a network device with firewall functionality. In an office that is the boundary firewall or router. For devices on networks you do not control, such as home broadband, the software firewall on the device provides the control.
Is A4.1 an automatic fail?
No. A4.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must have firewalls in place between your office network and the internet.
- Requirement enforced
You must protect every device in scope with a correctly configured firewall (or network device with firewall functionality).
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A3.3A4.1.1Back to the firewalls control
What does A4.1 ask?
A4.1 asks: “Do you have firewalls at the boundaries between your organisation’s internal networks, laptops, desktops, servers and the internet?”
A4.1 asks whether you have firewalls at the boundaries between your organisation's internal networks, laptops, desktops, servers and the internet. The guidance says you must have firewalls in place between your office network and the internet.
The requirement behind it, from v3.3: you must protect every device in scope with a correctly configured firewall, or network device with firewall functionality. Where your organisation does not control the network a device connects to, you must configure a software firewall on the device. For cloud services the control can be met with data flow policies. See firewalls requirements and boundary firewall.
What must be true to answer Yes to A4.1?
You can answer Yes to A4.1 only when all of the following are true today, across every device, user and cloud service in scope.
- Every office and site internet connection passes through a firewall or router with firewall functionality, listed in A2.5.
- Every laptop, desktop and server also has its software firewall enabled (A4.1.1), which covers devices when they leave the office.
- IaaS servers are protected by a cloud firewall or equivalent network policy you control.
- No device connects straight to the internet with no firewall in front of it or on it.
Why do applicants fail A4.1?
A common reason applicants fail A4.1: an ISP router used as the only boundary with its default settings and password unchanged.
- A server or IaaS virtual machine with a public IP address and no firewall policy.
- A site or backup connection not listed in A2.5, so its firewall cannot be checked.
- Home workers with software firewalls turned off.
How do you fix a failing A4.1 answer?
If your answer to A4.1 would not pass today, fix the control first and then write the answer. In order:
- Put a firewall or router with firewall functionality on every site internet connection and list it in A2.5.
- Turn on and enforce the software firewall on every laptop, desktop and server (A4.1.1) so devices are protected off-site.
- Apply a cloud firewall or network security policy you control to every IaaS server with a public address.
How do assessors check A4.1?
What evidence should you keep for A4.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.1:
- A diagram showing each internet connection and the firewall that protects it.
- The cloud firewall or network security policy for each IaaS server.
Where to go next
- Boundary firewallGlossary
- Software firewallGlossary
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.1.1A4.1.1Yes/NoDo you have software firewalls enabled on all of your computers, laptops and servers?Yes/No
- A4.1.2A4.1.2NotesIf you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems.Notes
- A4.2A4.2Yes/NoWhen you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?Yes/No
- A4.2.1A4.2.1NotesPlease describe the process for changing your firewall password.Notes
Frequently asked questions
A4.1 in the 2026 Danzell Cyber Essentials question set asks: "Do you have firewalls at the boundaries between your organisation’s internal networks, laptops, desktops, servers and the internet?" It is a Yes/No question.
To answer Yes to A4.1 every device in scope must be protected by a correctly configured firewall or a network device with firewall functionality. In an office that is the boundary firewall or router. For devices on networks you do not control, such as home broadband, the software firewall on the device provides the control.
No. A4.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
It can, if it has firewall functionality and is configured correctly: default password changed, unauthenticated inbound connections blocked, inbound rules approved and documented, and admin access not exposed to the internet without MFA or an IP allow list.
Then there is no boundary firewall to list, and every device relies on its software firewall. Answer A4.1 for that situation, explain it in the A2.5 notes, and answer Yes to A4.1.1.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh