A4.1.1: Are software firewalls enabled on all computers, laptops and servers?
Do you have software firewalls enabled on all of your computers, laptops and servers?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
To answer Yes to A4.1.1 the software firewall must be enabled at all times on every computer, laptop and server in scope, including devices that sit behind an office firewall. Windows Defender Firewall, the macOS firewall and the firewalls in common Linux distributions all qualify. Enforce the setting centrally so users cannot turn it off.
Is A4.1.1 an automatic fail?
No. A4.1.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Your software firewall needs to be configured and enabled at all times, even when sitting behind a physical/virtual boundary firewall in an office location.
- Requirement enforced
- Firewalls: To make sure that only secure and necessary network services can be accessed from the internet.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.1A4.1.2Back to the firewalls control
What does A4.1.1 ask?
A4.1.1 asks: “Do you have software firewalls enabled on all of your computers, laptops and servers?”
A4.1.1 asks whether you have software firewalls enabled on all of your computers, laptops and servers. The guidance says your software firewall needs to be configured and enabled at all times, even when sitting behind a physical or virtual boundary firewall in an office location.
v3.3 adds that most desktop and laptop operating systems come with a software firewall pre-installed and advises turning these on in preference to a third-party firewall application, and says to use a software firewall on devices used on untrusted networks such as public wifi hotspots. Guides: Windows 11, macOS, Microsoft Intune. See software firewall.
What must be true to answer Yes to A4.1.1?
You can answer Yes to A4.1.1 only when all of the following are true today, across every device, user and cloud service in scope.
- The firewall is on for every network profile (domain, private and public on Windows), not just public.
- It is enforced by policy (Intune, Group Policy, Jamf or another MDM) so users cannot switch it off.
- Servers have their host firewall enabled too, including domain controllers and IaaS virtual machines.
- BYOD laptops in scope have their built-in firewall enabled and you can show how you know.
Why do applicants fail A4.1.1?
A common reason applicants fail A4.1.1: windows Defender Firewall disabled on the domain profile because 'the office firewall covers it'.
- macOS firewall left at its default, which is off on many Macs until it is turned on.
- Servers with the host firewall turned off for convenience.
- BYOD laptops with no way of confirming the firewall is on.
How do you fix a failing A4.1.1 answer?
If your answer to A4.1.1 would not pass today, fix the control first and then write the answer. In order:
- Deploy a firewall policy through Intune, Group Policy or your Mac MDM that turns the firewall on for every network profile.
- Stop users switching it off by setting it through the management policy rather than locally.
- Turn on the host firewall on servers and IaaS virtual machines, adding rules for the services they need.
- Check BYOD laptops individually or through a compliance policy, and record the check.
How do assessors check A4.1.1?
What evidence should you keep for A4.1.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.1.1:
- The Intune, Group Policy or MDM profile that enforces the software firewall on all network profiles.
Where to go next
- Windows 11 setupSetup guide
- macOS setupSetup guide
- Microsoft Intune setupSetup guide
- Software firewallGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
Other A4 questions
- A4.1A4.1Yes/NoDo you have firewalls at the boundaries between your organisation’s internal networks, laptops, desktops, servers and the internet?Yes/No
- A4.1.2A4.1.2NotesIf you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems.Notes
- A4.2A4.2Yes/NoWhen you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?Yes/No
- A4.2.1A4.2.1NotesPlease describe the process for changing your firewall password.Notes
Frequently asked questions
A4.1.1 in the 2026 Danzell Cyber Essentials question set asks: "Do you have software firewalls enabled on all of your computers, laptops and servers?" It is a Yes/No question.
To answer Yes to A4.1.1 the software firewall must be enabled at all times on every computer, laptop and server in scope, including devices that sit behind an office firewall. Windows Defender Firewall, the macOS firewall and the firewalls in common Linux distributions all qualify. Enforce the setting centrally so users cannot turn it off.
No. A4.1.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. v3.3 advises using the software firewall that comes pre-installed with the operating system in preference to a third-party application. It must be enabled at all times.
Not always. Check System Settings, Network, Firewall on each Mac, or enforce it with an MDM profile, because A4.1.1 requires it to be enabled at all times.
Yes. A4.1.1 covers computers, laptops and servers, and the guidance says the software firewall must be enabled even behind a boundary firewall.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh