A4.9: Can your firewall configuration be reached from the internet?

What does A4.9 ask?

A4.9 asks: “Are your boundary firewalls configured to allow access to their configuration settings over the internet?”

A4.9 asks whether your boundary firewalls are configured to allow access to their configuration settings over the internet. The guidance notes that organisations sometimes allow an IT support company to change settings this way, and says that if your firewalls are not accessible to people outside your organisation, or the settings are only reachable via a VPN connection, you should answer No.

The requirement: prevent access to the administrative interface from the internet unless there is a clear and documented business need and the interface is protected by either multi-factor authentication or an IP allow list that limits access to a small range of trusted addresses combined with a properly managed password authentication approach. A Yes opens A4.10 and A4.11. See admin interface.

How should you answer A4.9?

A4.9 has no single compliant answer. Answer it accurately for your organisation today; this is what each answer means.

• Answer No if the admin interface is reachable only from the internal network or over a VPN.
• Answer No for cloud-managed firewalls whose configuration is reached only through the vendor portal, and make sure that portal account has MFA as a cloud service in A2.9 and A7.16.
• Answer Yes if the WAN interface accepts admin logins from the internet, including from your MSP's address; then A4.10 and A4.11 must both be satisfied.
• Check rather than assume: many routers enable remote management by default.

Why do applicants fail A4.9?

A common reason applicants fail A4.9: remote management left on the WAN port at its default setting.

How do you fix a failing A4.9 answer?

If your answer to A4.9 would not pass today, fix the control first and then write the answer. In order:

1. Check the WAN-side remote management setting on every firewall and router.
2. Turn it off if nobody needs it, and manage the device from inside the network or over a VPN.
3. If remote access must stay, document the need (A4.10) and protect it with MFA or an IP allow list plus a managed password (A4.11).

How do assessors check A4.9?

What evidence should you keep for A4.9?

The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A4.9:

• A screenshot of the remote management setting on each firewall.