A4.5: Do you have a process to manage your firewall?
Do you have a process to manage your firewall?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A4.5 if there is a defined process for changes to your firewall, in particular for opening ports to make an internal system reachable from the internet. Each such change needs a documented business case, approval by an authorised person, and removal when no longer needed.
Is A4.5 an automatic fail?
No. A4.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- At times your firewall may be configured to allow a system on the inside to become accessible from the internet (for example: a VPN server, a mail server, an FTP server, or a service that is accessed by your customers). This is sometimes referred to as "opening a port".
- Requirement enforced
- Firewalls: To make sure that only secure and necessary network services can be accessed from the internet.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.4A4.6Back to the firewalls control
What does A4.5 ask?
A4.5 asks: “Do you have a process to manage your firewall?”
A4.5 asks whether you have a process to manage your firewall. The guidance explains that at times a firewall may be configured to allow a system inside your network to become accessible from the internet, for example a VPN server, a mail server, an FTP server or a service used by customers, sometimes called 'opening a port', and that you need to show a business case for doing this because it can present security risks.
The process covers three requirements from v3.3: block unauthenticated inbound connections by default (A4.7), ensure inbound rules are approved and documented by an authorised person with the business need recorded (A4.8), and remove or disable unnecessary rules when no longer needed (A4.6). See port forwarding.
What must be true to answer Yes to A4.5?
You can answer Yes to A4.5 only when all of the following are true today, across every device, user and cloud service in scope.
- Firewall changes are requested, approved and made by named roles, not by whoever has the password.
- Any rule that allows inbound connections has a written business case and an approver.
- Rules are reviewed at least every 12 months (A4.6) and removed when no longer needed.
- If an MSP makes changes, you can see a record of what was changed and why.
Why do applicants fail A4.5?
A common reason applicants fail A4.5: no record of why a port was opened, sometimes years ago.
- Changes made by the MSP with no approval from the organisation.
- Temporary rules for a supplier or a project that were never removed.
- A Yes to A4.5 with nothing in A4.8 to back it up.
How do you fix a failing A4.5 answer?
If your answer to A4.5 would not pass today, fix the control first and then write the answer. In order:
- Write a short firewall change procedure: who requests, who approves, who makes the change and where it is recorded.
- Require a business case for every inbound rule, approved at board level (A4.8).
- Schedule a rule review at least every 12 months (A4.6).
How do assessors check A4.5?
What evidence should you keep for A4.5?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.5:
- The firewall change procedure and a recent completed change record.
Where to go next
- Firewall ruleGlossary
- Port forwardingGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.3A4.3Options A to EHow is your firewall password configured?Options A to E
- A4.4A4.4Yes/NoDo you change your firewall password when you know or suspect it has been compromised?Yes/No
- A4.6A4.6NotesHave you reviewed your firewall rules in the last 12 months?Notes
- A4.7A4.7Yes/NoIs your firewall configured to allow unauthenticated inbound connections?Yes/No
Frequently asked questions
A4.5 in the 2026 Danzell Cyber Essentials question set asks: "Do you have a process to manage your firewall?" It is a Yes/No question.
Answer Yes to A4.5 if there is a defined process for changes to your firewall, in particular for opening ports to make an internal system reachable from the internet. Each such change needs a documented business case, approval by an authorised person, and removal when no longer needed.
No. A4.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
A defined way of requesting, approving, recording and reviewing firewall changes, especially inbound rules. The business case and approval are recorded, and rules are removed when no longer needed.
Yes, a simple one. State that inbound connections are blocked by default and that any future rule would need a business case and approval from a named person.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh