A4.8: How do you approve and document allowed inbound connections?
Please describe how you approve and document your allowed inbound connections.
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A4.8 answer describes how each allowed inbound connection is approved and recorded: a written business case, sign-off at board level by an authorised person, and a regular review of the associated risks. If no inbound connections are allowed, say so and describe the approval a future one would need.
Is A4.8 an automatic fail?
No. A4.8 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- The business case should be documented and recorded. A business case must be signed off at board level and associated risks reviewed regularly.
- Requirement enforced
Ensure inbound firewall rules are approved and documented by an authorised person, and include the business need in the documentation.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.7A4.9Back to the firewalls control
What does A4.8 ask?
A4.8 asks: “Please describe how you approve and document your allowed inbound connections.”
A4.8 asks you to describe how you approve and document your allowed inbound connections. IASME's guidance says the business case should be documented and recorded, that a business case must be signed off at board level, and that associated risks should be reviewed regularly.
The requirement behind it: ensure inbound firewall rules are approved and documented by an authorised person, and include the business need in the documentation. Examples of inbound services given in the guidance are a VPN server, a mail server, an FTP server or a service accessed by your customers. The same documentation supports A4.10 if you allow remote access to the firewall's admin interface.
What should you write in the notes field for A4.8?
Write two to four specific sentences for A4.8: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Each inbound rule is recorded in the firewall change register held in [SharePoint / the MSP's ticketing system], with the service, port, source restrictions, the business need, the risk and the approver. Business cases are signed off by [director name and role]. Current allowed inbound connections: [VPN on UDP 500 and 4500 to the FortiGate, requires MFA; none other]. Risks are reviewed at the [annual] firewall review (A4.6).
Why do applicants fail A4.8?
A common reason applicants fail A4.8: approval by the IT provider rather than an authorised person in the organisation; the guidance expects board-level sign-off.
- Rules with no recorded business need.
- No register at all, only the firewall configuration.
- Describing outbound rules instead of inbound.
How do you fix a failing A4.8 answer?
If your answer to A4.8 would not pass today, fix the control first and then write the answer. In order:
- Create a firewall change register listing each inbound rule, the service, the business need, the risks, the approver and the date.
- Have a board-level person sign off each business case.
- Review the risks at each firewall rule review (A4.6).
How do assessors check A4.8?
What evidence should you keep for A4.8?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.8:
- The firewall change register: each inbound rule with its business case, approver and date.
Where to go next
- Firewall ruleGlossary
- Inbound connectionGlossary
- CE Plus test 1: external vulnerability scanHow exposed services are tested
- Firewalls requirementsThe control this question tests
- All A4 questionsFirewalls
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A4 questions
- A4.6A4.6NotesHave you reviewed your firewall rules in the last 12 months?Notes
- A4.7A4.7Yes/NoIs your firewall configured to allow unauthenticated inbound connections?Yes/No
- A4.9A4.9Yes/NoAre your boundary firewalls configured to allow access to their configuration settings over the internet?Yes/No
- A4.10A4.10Yes/NoIf you answered yes in question A4.9, is there a documented business requirement for this access?Yes/No
Frequently asked questions
A4.8 in the 2026 Danzell Cyber Essentials question set asks: "Please describe how you approve and document your allowed inbound connections." It is a notes question, answered in free text.
A compliant A4.8 answer describes how each allowed inbound connection is approved and recorded: a written business case, sign-off at board level by an authorised person, and a regular review of the associated risks. If no inbound connections are allowed, say so and describe the approval a future one would need.
No. A4.8 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
An authorised person, and IASME's A4.8 guidance says the business case must be signed off at board level. It should not be left to the IT provider alone.
The service, why it is needed, who approved it and when, and the risks considered. Keep it with the firewall change record so the A4.6 review can check it.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh