A4.4: Do you change the firewall password when it may be compromised?
Do you change your firewall password when you know or suspect it has been compromised?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A4.4 only if there is an established process to change the firewall or router admin password promptly when you know or suspect it has been compromised, for example after malware on an admin's device, a vendor security notice or a departing administrator. Where you rely on software firewalls, the device login password must be changed instead.
Is A4.4 an automatic fail?
No. A4.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Passwords may be compromised if there has been a virus on your system or if the manufacturer notifies you of a security weakness in their product. You should be aware of this and know how to change the password if this occurs.
- Requirement enforced
You should make sure there is an established process in place to change passwords promptly if you know or suspect a password or account has been compromised.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.3A4.5Back to the firewalls control
What does A4.4 ask?
A4.4 asks: “Do you change your firewall password when you know or suspect it has been compromised?”
A4.4 asks whether you change your firewall password when you know or suspect it has been compromised. The guidance gives two triggers: a virus on your system, or the manufacturer notifying you of a security weakness in their product. You should be aware of this and know how to change the password.
The requirement behind it: make sure there is an established process in place to change passwords promptly if you know or suspect a password or account has been compromised. The same requirement sits behind A5.6 and A7.13.
What must be true to answer Yes to A4.4?
You can answer Yes to A4.4 only when all of the following are true today, across every device, user and cloud service in scope.
- Someone is named as responsible for changing the firewall password, and they know how (A4.2.1).
- The triggers are written down: malware on an admin device, a vendor advisory, an admin leaving, a password exposed in a breach.
- You subscribe to the vendor's security advisories so you hear about weaknesses.
- For software firewalls, the user's device password is changed when compromise is suspected.
Why do applicants fail A4.4?
A common reason applicants fail A4.4: no owner for the firewall credential, so nobody would act on a vendor advisory.
- Not changing the password when an administrator or MSP engineer leaves.
- No subscription to the vendor's security notifications.
- Answering Yes without a written process.
How do you fix a failing A4.4 answer?
If your answer to A4.4 would not pass today, fix the control first and then write the answer. In order:
- Name the person responsible for the firewall credential.
- Subscribe to the vendor's security advisories.
- Write the triggers into your incident procedure: malware on an admin device, a vendor advisory, an admin leaving, a credential in a breach.
- State that the password is changed promptly on any trigger.
How do assessors check A4.4?
What evidence should you keep for A4.4?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.4:
- The incident procedure naming firewall credentials, and the vendor advisory subscription.
Where to go next
- Security updateGlossary
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.2.1A4.2.1NotesPlease describe the process for changing your firewall password.Notes
- A4.3A4.3Options A to EHow is your firewall password configured?Options A to E
- A4.5A4.5Yes/NoDo you have a process to manage your firewall?Yes/No
- A4.6A4.6NotesHave you reviewed your firewall rules in the last 12 months?Notes
Frequently asked questions
A4.4 in the 2026 Danzell Cyber Essentials question set asks: "Do you change your firewall password when you know or suspect it has been compromised?" It is a Yes/No question.
Answer Yes to A4.4 only if there is an established process to change the firewall or router admin password promptly when you know or suspect it has been compromised, for example after malware on an admin's device, a vendor security notice or a departing administrator. Where you rely on software firewalls, the device login password must be changed instead.
No. A4.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. v3.3 says not to enforce regular password expiry. Change it when you know or suspect it has been compromised.
The A4.4 guidance gives malware on your system and a manufacturer's notice of a security weakness. A departing administrator or a credential appearing in a breach are also sensible triggers.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh