A4.3: How is your firewall password configured? (options A to E)
How is your firewall password configured? Please select the option being used: A. Multi-factor authentication, with a minimum password length 8 characters and no maximum length B. Automatic blocking of common passwords, with a minimum password length 8 characters and no maximum length C. A password minimum length of 12 characters and no maximum length D. Passwordless system is being used as an alternative to user name and password, please describe E. None of the above, please describe
Source: IASME Cyber Essentials Danzell question set v16.3
Options A to D pass A4.3: MFA with a password of at least 8 characters, automatic blocking of common passwords with at least 8 characters, a 12-character minimum with no maximum, or a passwordless system you describe. Option E, none of the above, means the firewall admin credential does not meet the requirement.
Is A4.3 an automatic fail?
No. A4.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Options A to E a multiple choice question with options A to E
- IASME guidance
- Acceptable technical controls that you can use to manage the quality of your passwords are outlined in the section about password-based authentication in the ‘Cyber Essentials Requirements for IT Infrastructure’ document.
- Requirement enforced
- Firewalls: To make sure that only secure and necessary network services can be accessed from the internet.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.2.1A4.4Back to the firewalls control
What does A4.3 ask?
A4.3 asks: “How is your firewall password configured? Please select the option being used: A. Multi-factor authentication, with a minimum password length 8 characters and no maximum length B. Automatic blocking of common passwords, with a minimum password length 8 characters and no maximum length C. A password minimum length of 12 characters and no maximum length D. Passwordless system is being used as an alternative to user name and password, please describe E. None of the above, please describe”
A4.3 asks which technical control manages the quality of the administrative password on each firewall or router in scope. The options mirror the password-based authentication section of the requirements: MFA with a password element of at least 8 characters; a minimum password length of at least 12 characters with no maximum; or at least 8 characters with automatic blocking of common passwords using a deny list.
Option D, passwordless, is new wording in the Danzell set and requires a notes description. Option E, none of the above, also requires notes and does not meet the requirement.
The question applies to every device listed in A2.5. The answer-type note in the Danzell spreadsheet says applicants must be able to select all five options, so if different devices use different controls, select each one in use and say in the notes which device uses which.
Which option should you choose for A4.3?
Choose the option for A4.3 that is enforced today across the whole scope, and complete the notes wherever the option requires them.
Option A: pick this if the firewall's admin login has MFA (for example a cloud-managed firewall with an authenticator app) and the password is at least 8 characters. Option B: pick this only if the device or its management platform actively blocks common passwords; most on-premises firewalls do not. Option C: the safest choice for most organisations, a 12-character or longer admin password with no MFA. Option D: describe the passwordless method (for example FIDO2 key on the management portal). Option E: does not pass; fix the credential first.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[For option D] The [make and model] firewall is managed through [cloud portal], where administrators authenticate with [FIDO2 security key / passkey] and no password is used. Local console access is [disabled / protected by a 16-character password stored in the password manager]. [For option C, notes optional] All [n] firewalls listed in A2.5 use unique administrative passwords of at least 12 characters generated by [password manager], changed from default at installation and after any suspected compromise (A4.4).
Why do applicants fail A4.3?
A common reason applicants fail A4.3: choosing option A because the firewall vendor's portal has MFA, while the local admin login still uses a short password.
- Choosing option B for a device that has no deny list. Assessors know which products do.
- Selecting option E, or leaving the default password, on a router supplied by the ISP that is still the boundary device.
- Different answers for the same device across A4.3, A4.2 and A4.11.
How do you fix a failing A4.3 answer?
If your answer to A4.3 would not pass today, fix the control first and then write the answer. In order:
- Find which option each firewall actually uses: MFA, a deny list, a 12-character minimum or passwordless.
- If none applies, set a unique admin password of at least 12 characters and choose option C.
- Where the device or its cloud portal supports MFA for admins, turn it on and choose option A.
- If different devices use different controls, select each option in use and say which device uses which.
How do assessors check A4.3?
What evidence should you keep for A4.3?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.3:
- A screenshot of the firewall admin account settings showing MFA, or the password policy applied.
Where to go next
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- Passwordless authenticationGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.2A4.2Yes/NoWhen you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?Yes/No
- A4.2.1A4.2.1NotesPlease describe the process for changing your firewall password.Notes
- A4.4A4.4Yes/NoDo you change your firewall password when you know or suspect it has been compromised?Yes/No
- A4.5A4.5Yes/NoDo you have a process to manage your firewall?Yes/No
Frequently asked questions
A4.3 in the 2026 Danzell Cyber Essentials question set asks: "How is your firewall password configured? Please select the option being used: A. Multi-factor authentication, with a minimum password length 8 characters and no maximum length B. Automatic blocking of common passwords, with a minimum password length 8 characters and no maximum length C. A password minimum length of 12 characters and no maximum length D. Passwordless system is being used as an alternative to user name and password, please describe E. None of the above, please describe" It is a multiple choice question with options A to E.
Options A to D pass A4.3: MFA with a password of at least 8 characters, automatic blocking of common passwords with at least 8 characters, a 12-character minimum with no maximum, or a passwordless system you describe. Option E, none of the above, means the firewall admin credential does not meet the requirement.
No. A4.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
12 characters with no maximum if you rely on length alone (option C), or 8 characters where MFA is in place (option A) or a deny list blocks common passwords (option B). Those thresholds come from the password-based authentication section of the requirements.
Option E means none of the compliant controls is in place, so the requirement to change default administrative passwords to a strong and unique password is not met. Change the password to at least 12 characters and answer C.
A method that establishes identity using a factor other than knowledge: FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications. Describe it in the notes so the assessor can see that no password is used for administration.
Only to routers your organisation supplied. Home routers you did not supply are out of scope, and A4.2.1's own text says so. Remote workers rely on the software firewall on their device instead.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh