A4.11: How is internet access to your firewall settings protected?
If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?
Source: IASME Cyber Essentials Danzell question set v16.3
A4.11 appears if you answered Yes to A4.9. State which of the two accepted protections guards the firewall's admin interface: multi-factor authentication, or an IP allow list limiting access to a small range of trusted addresses combined with a properly managed password. Name the product setting and the addresses or MFA method so the assessor can check it.
Is A4.11 an automatic fail?
No. A4.11 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- If you allow direct access to configuration settings via your router or firewall's external interface, this must be protected by one of the two options. Please explain which option is used.
- Logic
- If yes to question A4.9
- Requirement enforced
Prevent access to the administrative interface (used to manage firewall configuration) from the internet, unless there is a clear and documented business need, and the interface is protected by one of the following controls:
- multi-factor authentication
- an IP allow list that limits access to a small range of trusted addresses combined with a properly managed password authentication approach
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.10A5.1Back to the firewalls control
What does A4.11 ask?
A4.11 asks: “If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?”
A4.11 asks, if you answered Yes to A4.9, whether access to your firewall settings is protected by multi-factor authentication or by allowing only trusted IP addresses combined with managed authentication. The guidance says direct access via the external interface must be protected by one of the two options, and asks you to explain which is used.
An IP allow list on its own is not enough: it must be combined with a properly managed password, which in practice means one that meets the password rules in A4.3. Platform guides: FortiGate, DrayTek, Sophos Firewall, UniFi, WatchGuard.
What should you write in the notes field for A4.11?
Write two to four specific sentences for A4.11: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Remote administration of the [make and model] is restricted to [the MSP's two static IP addresses, x.x.x.x and y.y.y.y] using the device's trusted hosts setting, and the admin account uses a unique [16]-character password stored in [password manager]. [Or: Admin login on the WAN interface requires MFA through [FortiToken / authenticator app] for every administrator account.] The business need is recorded in A4.10.
Why do applicants fail A4.11?
A common reason applicants fail A4.11: an allow list that includes a whole ISP range or 'any'.
- An allow list with the default or a weak admin password.
- MFA on the vendor portal but not on direct WAN logins.
- Saying 'protected' without naming which of the two options.
How do you fix a failing A4.11 answer?
If your answer to A4.11 would not pass today, fix the control first and then write the answer. In order:
- Turn on MFA for admin logins on the WAN interface, or restrict admin access to a handful of trusted static IP addresses.
- If you use an allow list, also set a unique admin password of at least 12 characters.
- Name the setting and the addresses or MFA method in the notes.
How do assessors check A4.11?
What evidence should you keep for A4.11?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.11:
- The trusted hosts or allow list configuration, or the MFA setting on the admin login.
Where to go next
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- Allow listingGlossary
- Multi-factor authenticationGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.7A4.7Yes/NoIs your firewall configured to allow unauthenticated inbound connections?Yes/No
- A4.8A4.8NotesPlease describe how you approve and document your allowed inbound connections.Notes
- A4.9A4.9Yes/NoAre your boundary firewalls configured to allow access to their configuration settings over the internet?Yes/No
- A4.10A4.10Yes/NoIf you answered yes in question A4.9, is there a documented business requirement for this access?Yes/No
Frequently asked questions
A4.11 in the 2026 Danzell Cyber Essentials question set asks: "If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?" It is a notes question, answered in free text.
A4.11 appears if you answered Yes to A4.9. State which of the two accepted protections guards the firewall's admin interface: multi-factor authentication, or an IP allow list limiting access to a small range of trusted addresses combined with a properly managed password. Name the product setting and the addresses or MFA method so the assessor can check it.
No. A4.11 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Only when combined with a properly managed password. The requirement is an IP allow list that limits access to a small range of trusted addresses combined with a properly managed password authentication approach, or MFA.
Yes. It is a notes question. Explain which of the two options you use and how it is configured.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh