A4.7: Does your firewall allow unauthenticated inbound connections?
Is your firewall configured to allow unauthenticated inbound connections?
Compliant answerNo
Source: IASME Cyber Essentials Danzell question set v16.3
The compliant answer to A4.7 is No. Your firewalls must block unauthenticated inbound connections by default, which is how most firewalls ship. Any inbound access you need, such as a VPN or a published service, must require authentication or be explicitly approved and documented under A4.8. Check the settings rather than assuming the default is still in place.
Is A4.7 an automatic fail?
No. A4.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- No
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- By default, most firewalls block all services inside the network from being accessed from the internet, but you need to check your firewall settings.
- Requirement enforced
Block unauthenticated inbound connections by default.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.6A4.8Back to the firewalls control
What does A4.7 ask?
A4.7 asks: “Is your firewall configured to allow unauthenticated inbound connections?”
A4.7 asks whether your firewall is configured to allow unauthenticated inbound connections. Unusually, No is the compliant answer. The guidance says most firewalls block all services inside the network from being accessed from the internet by default, but you need to check your firewall settings.
The requirement behind it: block unauthenticated inbound connections by default. Port forwards, UPnP and 'DMZ host' settings on routers are the usual ways unauthenticated access creeps in. See inbound connection and CE Plus test case 1, which scans for exposed services.
What must be true to answer No to A4.7?
You can answer No to A4.7 only when all of the following are true today, across every device, user and cloud service in scope.
- The default inbound policy on every firewall in A2.5 is deny.
- Port forwards exist only for approved services that require authentication, each documented in A4.8.
- UPnP is disabled on routers, and no device is set as a 'DMZ host'.
- Cloud firewalls and security policies for IaaS servers also deny inbound traffic by default.
Why do applicants fail A4.7?
A common reason applicants fail A4.7: UPnP left enabled on a router, letting devices open their own ports.
- A port forward for remote desktop (RDP) or a camera system that nobody remembers.
- An IaaS server with an 'allow any' inbound rule.
- Answering Yes because the question is misread; Yes means you allow unauthenticated connections.
How do you fix a failing A4.7 answer?
If your answer to A4.7 would not pass today, fix the control first and then write the answer. In order:
- Confirm the default inbound policy on every firewall is deny.
- Remove unused port forwards, disable UPnP and clear any 'DMZ host' setting.
- Put services such as remote desktop behind a VPN or gateway that requires authentication.
- Record every remaining inbound rule and its approval in A4.8.
How do assessors check A4.7?
What evidence should you keep for A4.7?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.7:
- An export of the inbound rule set showing default deny and each allowed rule.
Where to go next
- Inbound connectionGlossary
- Remote Desktop ProtocolGlossary
- CE Plus test 1: external scanCyber Essentials Plus
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.5A4.5Yes/NoDo you have a process to manage your firewall?Yes/No
- A4.6A4.6NotesHave you reviewed your firewall rules in the last 12 months?Notes
- A4.8A4.8NotesPlease describe how you approve and document your allowed inbound connections.Notes
- A4.9A4.9Yes/NoAre your boundary firewalls configured to allow access to their configuration settings over the internet?Yes/No
Frequently asked questions
A4.7 in the 2026 Danzell Cyber Essentials question set asks: "Is your firewall configured to allow unauthenticated inbound connections?" It is a Yes/No question.
The compliant answer to A4.7 is No. Your firewalls must block unauthenticated inbound connections by default, which is how most firewalls ship. Any inbound access you need, such as a VPN or a published service, must require authentication or be explicitly approved and documented under A4.8. Check the settings rather than assuming the default is still in place.
No. A4.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. A4.7 asks whether your firewall allows unauthenticated inbound connections, and the requirement is to block them by default.
Exposing RDP directly is an unauthenticated inbound connection at the network level and a common route for attacks. Put it behind a VPN or a gateway that requires MFA, and document the business need in A4.8.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh