A4.1.2: Which operating systems have no software firewall?
If you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems.
Source: IASME Cyber Essentials Danzell question set v16.3
A4.1.2 only appears if you answered No to A4.1.1. It asks whether the operating system lacks a software firewall, and which ones. IASME's guidance says very few lack one: all versions of Windows, macOS and common Linux distributions such as Ubuntu have a software firewall, so a No for those will not be accepted.
Is A4.1.2 an automatic fail?
No. A4.1.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Only very few operating systems do not have software firewalls available. Examples might include embedded Linux systems or bespoke servers.
- Logic
- Only show if no to A4.1.1
- Requirement enforced
- Firewalls: To make sure that only secure and necessary network services can be accessed from the internet.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.1.1A4.2Back to the firewalls control
What does A4.1.2 ask?
A4.1.2 asks: “If you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems.”
A4.1.2 asks, if you answered No to A4.1.1, whether that is because software firewalls are not installed by default as part of the operating system, and to list the operating systems.
The guidance says only very few operating systems do not have software firewalls available, gives embedded Linux systems and bespoke servers as examples, and states for the avoidance of doubt that all versions of Windows, macOS and all common Linux distributions such as Ubuntu do have them.
What should you write in the notes field for A4.1.2?
Write two to four specific sentences for A4.1.2: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Operating system and version], running on [n] x [device type and purpose], does not include a software firewall. These devices sit on [network] behind the [make and model] boundary firewall listed in A2.5, which blocks all unauthenticated inbound connections, and are never used on networks we do not control. (Or: not applicable; all devices have their software firewall enabled.)
Why do applicants fail A4.1.2?
A common reason applicants fail A4.1.2: listing Windows, macOS or Ubuntu, which the guidance says all have software firewalls.
- Giving 'performance' or 'it breaks an application' as the reason; that is a configuration choice, not a missing firewall.
- An embedded device that is also used off-site, where no boundary firewall protects it.
- No explanation of what protects the device instead.
How do you fix a failing A4.1.2 answer?
If your answer to A4.1.2 would not pass today, fix the control first and then write the answer. In order:
- If the operating system is Windows, macOS or a common Linux distribution, turn its firewall on and answer Yes to A4.1.1 instead.
- For a genuinely firewall-less embedded system, name it and the boundary firewall that protects it at all times.
How do assessors check A4.1.2?
What evidence should you keep for A4.1.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.1.2:
- The vendor documentation showing the operating system has no software firewall, and the boundary firewall that protects it.
Where to go next
- Software firewallGlossary
- Boundary firewallGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.1A4.1Yes/NoDo you have firewalls at the boundaries between your organisation’s internal networks, laptops, desktops, servers and the internet?Yes/No
- A4.1.1A4.1.1Yes/NoDo you have software firewalls enabled on all of your computers, laptops and servers?Yes/No
- A4.2A4.2Yes/NoWhen you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?Yes/No
- A4.2.1A4.2.1NotesPlease describe the process for changing your firewall password.Notes
Frequently asked questions
A4.1.2 in the 2026 Danzell Cyber Essentials question set asks: "If you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems." It is a notes question, answered in free text.
A4.1.2 only appears if you answered No to A4.1.1. It asks whether the operating system lacks a software firewall, and which ones. IASME's guidance says very few lack one: all versions of Windows, macOS and common Linux distributions such as Ubuntu have a software firewall, so a No for those will not be accepted.
No. A4.1.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. The guidance for A4.1.2 only covers operating systems without a software firewall. Configure the firewall to allow the application instead of turning it off.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh