A4.10: Is there a documented business need for internet access to the firewall?
If you answered yes in question A4.9, is there a documented business requirement for this access?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
A4.10 appears if you answered Yes to A4.9. Answer Yes only if the decision to allow access to the firewall's settings from the internet is written down with the business need, who approved it and when. A typical example is an MSP that manages the device remotely. Without that record, the requirement is not met.
Is A4.10 an automatic fail?
No. A4.10 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- When you have made a decision to provide external access to your routers and firewalls, this decision must be documented (for example, written down).
- Logic
- If yes to question A4.9
- Requirement enforced
Ensure inbound firewall rules are approved and documented by an authorised person, and include the business need in the documentation.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.9A4.11Back to the firewalls control
What does A4.10 ask?
A4.10 asks: “If you answered yes in question A4.9, is there a documented business requirement for this access?”
A4.10 asks, if you answered Yes to A4.9, whether there is a documented business requirement for this access. The guidance says that when you decide to provide external access to your routers and firewalls, the decision must be documented, for example written down.
The requirement behind it is the same as for inbound rules: approved and documented by an authorised person, with the business need included. Record it alongside the inbound rules in A4.8.
What must be true to answer Yes to A4.10?
You can answer Yes to A4.10 only when all of the following are true today, across every device, user and cloud service in scope.
- There is a written record of why internet access to the admin interface is needed.
- It names who approved it and when.
- It is reviewed with the firewall rules at least every 12 months (A4.6).
- The protection in A4.11 is described in the same record.
Why do applicants fail A4.10?
A common reason applicants fail A4.10: remote admin enabled 'because the installer turned it on', with no decision recorded.
- A record that says the MSP needs access but not who approved it.
- A business need that has lapsed, for example a former MSP.
- No review of whether the access is still needed.
How do you fix a failing A4.10 answer?
If your answer to A4.10 would not pass today, fix the control first and then write the answer. In order:
- Write down why internet access to the admin interface is needed, who approved it and when.
- Keep it with the firewall change register and review it at each rule review.
- If the need has lapsed, for example a former MSP, turn remote management off and answer No to A4.9.
How do assessors check A4.10?
What evidence should you keep for A4.10?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.10:
- The written business case for remote admin access, with approver and date.
Where to go next
- Admin interfaceGlossary
- Managed service providerGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.7A4.7Yes/NoIs your firewall configured to allow unauthenticated inbound connections?Yes/No
- A4.8A4.8NotesPlease describe how you approve and document your allowed inbound connections.Notes
- A4.9A4.9Yes/NoAre your boundary firewalls configured to allow access to their configuration settings over the internet?Yes/No
- A4.11A4.11NotesIf you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentica…Notes
Frequently asked questions
A4.10 in the 2026 Danzell Cyber Essentials question set asks: "If you answered yes in question A4.9, is there a documented business requirement for this access?" It is a Yes/No question.
A4.10 appears if you answered Yes to A4.9. Answer Yes only if the decision to allow access to the firewall's settings from the internet is written down with the business need, who approved it and when. A typical example is an MSP that manages the device remotely. Without that record, the requirement is not met.
No. A4.10 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
A written record of why access is needed, who approved it and when, kept with your firewall change records. IASME's guidance says the decision must be documented, for example written down.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh