A4.2.1: How do you change your firewall password?
Please describe the process for changing your firewall password. Home routers not supplied by your organisation are not included in this requirement.
Source: IASME Cyber Essentials Danzell question set v16.3
A4.2.1 needs a short description of how the administrator password on your firewalls and routers is changed: who does it, through which interface, and where the new password is stored. Home routers your organisation did not supply are not included. If an MSP manages the devices, describe their process and how you confirm it is followed.
Is A4.2.1 an automatic fail?
No. A4.2.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You need to understand how the password on your firewall(s) is changed. Please provide a brief description of how this is achieved.
- Requirement enforced
- Firewalls: To make sure that only secure and necessary network services can be accessed from the internet.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.2A4.3Back to the firewalls control
What does A4.2.1 ask?
A4.2.1 asks: “Please describe the process for changing your firewall password. Home routers not supplied by your organisation are not included in this requirement.”
A4.2.1 asks you to describe the process for changing your firewall password, and states that home routers not supplied by your organisation are not included. The guidance says you need to understand how the password on your firewalls is changed and to give a brief description.
The answer supports A4.2 and A4.4: you need to be able to change the password at installation and again promptly if it is compromised.
What should you write in the notes field for A4.2.1?
Write two to four specific sentences for A4.2.1: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
The admin password on the [make and model] firewall is changed by [role or MSP name] through [the web management interface over the internal network / the cloud management portal], under [the administrator settings page]. A new password of at least [16] characters is generated in [password manager] and stored in the shared IT vault, accessible only to [named roles]. It is changed at installation, when an administrator leaves, and immediately if compromise is suspected (A4.4).
Why do applicants fail A4.2.1?
A common reason applicants fail A4.2.1: 'Our IT company does it' with no description of the process.
- A process that relies on one person who has left.
- Passwords stored in a spreadsheet or on a sticky note.
- No mention of when the password is changed.
How do you fix a failing A4.2.1 answer?
If your answer to A4.2.1 would not pass today, fix the control first and then write the answer. In order:
- Write down who changes the firewall admin password, through which interface, and where the new password is stored.
- Store it in a shared password manager vault limited to named roles, not a spreadsheet.
- State when it is changed: at installation, when an admin leaves, and on suspected compromise.
How do assessors check A4.2.1?
What evidence should you keep for A4.2.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.2.1:
- The written procedure for changing the firewall password and the vault where it is stored.
Where to go next
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- Password managerGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.1.2A4.1.2NotesIf you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems.Notes
- A4.2A4.2Yes/NoWhen you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?Yes/No
- A4.3A4.3Options A to EHow is your firewall password configured?Options A to E
- A4.4A4.4Yes/NoDo you change your firewall password when you know or suspect it has been compromised?Yes/No
Frequently asked questions
A4.2.1 in the 2026 Danzell Cyber Essentials question set asks: "Please describe the process for changing your firewall password. Home routers not supplied by your organisation are not included in this requirement." It is a notes question, answered in free text.
A4.2.1 needs a short description of how the administrator password on your firewalls and routers is changed: who does it, through which interface, and where the new password is stored. Home routers your organisation did not supply are not included. If an MSP manages the devices, describe their process and how you confirm it is followed.
No. A4.2.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. The question itself says home routers not supplied by your organisation are not included.
Describe the MSP's process and how you know it is followed. v3.3 says that if you use externally managed services you must be able to confirm the technical controls are met.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh