A4.6: Have you reviewed your firewall rules in the last 12 months?
Have you reviewed your firewall rules in the last 12 months? Please describe your review process.
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A4.6 answer confirms a review of the firewall rules within the last 12 months and describes the process: when reviews happen, who decides which services to remove, and who checks it has been done. The requirement is to remove or disable inbound firewall rules quickly when they are no longer needed.
Is A4.6 an automatic fail?
No. A4.6 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- If you no longer need a service to be enabled on your firewall, you must remove it to reduce the risk of compromise. ).
- Requirement enforced
Remove or disable inbound firewall rules quickly when they are no longer needed.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.5A4.7Back to the firewalls control
What does A4.6 ask?
A4.6 asks: “Have you reviewed your firewall rules in the last 12 months? Please describe your review process.”
A4.6 asks whether you have reviewed your firewall rules in the last 12 months, and to describe your review process. The guidance says that if you no longer need a service enabled on your firewall you must remove it to reduce the risk of compromise, and that your process should say when services are reviewed, who decides to remove them and who checks that it has been done.
The requirement behind it: remove or disable inbound firewall rules quickly when they are no longer needed. The approvals recorded in A4.8 are what the review checks against. See firewall rule.
What should you write in the notes field for A4.6?
Write two to four specific sentences for A4.6: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Yes. The inbound rules on the [make and model] firewall were last reviewed on [date] by [role / MSP name] and approved by [director]. Reviews take place [every six months / annually] and whenever a service is retired. Each rule is checked against the register of approved business cases (see A4.8); any rule without a current business need is disabled the same day and removed after [n] days. [Role] confirms the change in the firewall's audit log and updates the register.
Why do applicants fail A4.6?
A common reason applicants fail A4.6: no review in the last 12 months.
- A review process with no owner and no record.
- Rules for retired services, old suppliers or test projects still in place.
- Reviewing only the head office firewall and forgetting branches and cloud firewalls.
How do you fix a failing A4.6 answer?
If your answer to A4.6 would not pass today, fix the control first and then write the answer. In order:
- Export the inbound rule set from every firewall in A2.5, including cloud firewalls.
- Check each rule against its recorded business case; disable any without a current need.
- Record the date, reviewer, approver and changes, and set the next review date.
How do assessors check A4.6?
What evidence should you keep for A4.6?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.6:
- The dated record of the last firewall rule review, with the reviewer and the changes made.
Where to go next
- Firewall ruleGlossary
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.4A4.4Yes/NoDo you change your firewall password when you know or suspect it has been compromised?Yes/No
- A4.5A4.5Yes/NoDo you have a process to manage your firewall?Yes/No
- A4.7A4.7Yes/NoIs your firewall configured to allow unauthenticated inbound connections?Yes/No
- A4.8A4.8NotesPlease describe how you approve and document your allowed inbound connections.Notes
Frequently asked questions
A4.6 in the 2026 Danzell Cyber Essentials question set asks: "Have you reviewed your firewall rules in the last 12 months? Please describe your review process." It is a notes question, answered in free text.
A compliant A4.6 answer confirms a review of the firewall rules within the last 12 months and describes the process: when reviews happen, who decides which services to remove, and who checks it has been done. The requirement is to remove or disable inbound firewall rules quickly when they are no longer needed.
No. A4.6 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
A4.6 asks about a review in the last 12 months, so at least annually. Review sooner when a service is retired, a supplier changes or a project ends.
Say so, and describe the review that confirmed it, with the date and who carried it out.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh