A4.2: Have you changed the default passwords on your firewalls and routers?
When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
To answer Yes to A4.2 the default administrator password must have been changed on every router and firewall in scope, including devices shipped with a unique pre-set password such as a BT Business Hub or DrayTek Vigor. The replacement must be strong and unique under the password rules, or remote administrative access must be disabled entirely.
Is A4.2 an automatic fail?
No. A4.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- The default administrator password must be changed on all routers and firewalls, including those that come with a unique password pre-configured (e.g. BT Business Hub, Draytek Vigor 2865ac). When relying on software firewalls included as part of the operating system of your end user devices, the password to access th…
- Requirement enforced
Change default administrative passwords to a strong and unique password – or disable remote administrative access entirely.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.1.2A4.2.1Back to the firewalls control
What does A4.2 ask?
A4.2 asks: “When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?”
A4.2 asks whether you have changed all the default passwords on your boundary firewall devices. The guidance says the default administrator password must be changed on all routers and firewalls, including those that come with a unique password pre-configured, and names the BT Business Hub and DrayTek Vigor 2865ac as examples.
Where you rely on the software firewalls in your devices' operating systems, the guidance says the password to access the device will need to be changed. The requirement behind it: change default administrative passwords to a strong and unique password, or disable remote administrative access entirely. The password quality options are in A4.3. See default password.
What must be true to answer Yes to A4.2?
You can answer Yes to A4.2 only when all of the following are true today, across every device, user and cloud service in scope.
- Every device in A2.5, including ISP routers and backup 4G routers, has had its default admin password replaced.
- The new password meets A4.3: at least 12 characters, or at least 8 with MFA or a deny list, or a passwordless method.
- Each device has its own password, stored in a password manager, not reused across sites.
- Unique pre-set passwords printed on a sticker have also been replaced.
Why do applicants fail A4.2?
A common reason applicants fail A4.2: leaving the unique password printed on the ISP router's label, which the guidance says must still be changed.
- Changing the web admin password but leaving a default on SSH or a secondary admin account.
- One password reused on every firewall across every site.
- An MSP-installed firewall where nobody in the organisation knows whether the default was changed.
How do you fix a failing A4.2 answer?
If your answer to A4.2 would not pass today, fix the control first and then write the answer. In order:
- Sign in to each router and firewall in A2.5, including ISP and backup routers, and replace the default or sticker password.
- Generate a unique password of at least 12 characters in a password manager for each device.
- Check secondary admin accounts and SSH access for defaults too, or disable remote administration entirely.
How do assessors check A4.2?
What evidence should you keep for A4.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.2:
- A password manager entry for each firewall admin credential (not the password itself), showing it was changed from default.
Where to go next
- Default passwordGlossary
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- Password managerGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.1.1A4.1.1Yes/NoDo you have software firewalls enabled on all of your computers, laptops and servers?Yes/No
- A4.1.2A4.1.2NotesIf you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems.Notes
- A4.2.1A4.2.1NotesPlease describe the process for changing your firewall password.Notes
- A4.3A4.3Options A to EHow is your firewall password configured?Options A to E
Frequently asked questions
A4.2 in the 2026 Danzell Cyber Essentials question set asks: "When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?" It is a Yes/No question.
To answer Yes to A4.2 the default administrator password must have been changed on every router and firewall in scope, including devices shipped with a unique pre-set password such as a BT Business Hub or DrayTek Vigor. The replacement must be strong and unique under the password rules, or remote administrative access must be disabled entirely.
No. A4.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes, if it is in scope. IASME's A4.2 guidance names the BT Business Hub as an example of a device whose unique pre-configured password must still be changed.
At least 12 characters with no maximum, or at least 8 with MFA or a deny list of common passwords. Store it in a password manager. These are the options in A4.3.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh