A2.3.2: How are your sites connected?
If no, please describe the way that your sites are connected.
Source: IASME Cyber Essentials Danzell question set v16.3
A2.3.2 appears if you answered No to A2.3.1. Describe how sites without their own internet connection reach the internet: for example a site-to-site VPN between firewalls, an MPLS or private circuit, or SD-WAN, and where the internet breakout and boundary firewall sit. Name the equipment at each end so the assessor can match it to A2.5.
Is A2.3.2 an automatic fail?
No. A2.3.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please give details of the connection methods between your interconnected sites.
- Logic
- If no to A2.3.1
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.3.2 ask?
A2.3.2 asks: “If no, please describe the way that your sites are connected.”
A2.3.2 asks how your sites are connected if they do not each have their own internet connection. The guidance asks for details of the connection methods between your interconnected sites.
The point of the question is to locate your internet boundary. If branch traffic goes to head office and out through one firewall, that firewall protects every site and must meet all the firewall requirements in section A4. See firewalls requirements.
What should you write in the notes field for A2.3.2?
Write two to four specific sentences for A2.3.2: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Branch site] connects to [head office] over [site-to-site IPsec VPN between FortiGate 60F units / an MPLS circuit from provider]. The branch has no direct internet access; all internet traffic breaks out through the [make and model] boundary firewall at [head office], listed in A2.5.
Why do applicants fail A2.3.2?
A common reason applicants fail A2.3.2: describing the link but not where the internet breakout is.
- Not mentioning a local internet connection used as a backup at the branch.
- Naming a provider ('BT handles it') rather than the connection type and equipment.
- Equipment named here that is missing from A2.5.
How do you fix a failing A2.3.2 answer?
If your answer to A2.3.2 would not pass today, fix the control first and then write the answer. In order:
- Name the connection type between sites (site-to-site VPN, private circuit, SD-WAN) and the equipment at each end.
- Say where the internet breakout is and which A2.5 firewall protects it.
- Mention any local backup connection at a branch.
How do assessors check A2.3.2?
What evidence should you keep for A2.3.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.3.2:
- A diagram or note of the inter-site links and the internet breakout point.
Where to go next
Other A2 questions
- A2.3A2.3NotesAre the networks included in the scope of this assessment being used at the company locations you provided earlier?Notes
- A2.3.1A2.3.1Yes/NoDo you have an internet connection for each site in your organisation?Yes/No
- A2.4A2.4NotesPlease provide a list of networks that will be in scope for this assessment.Notes
- A2.4.1A2.4.1NotesHow many staff are home or remote workers?Notes
Frequently asked questions
A2.3.2 in the 2026 Danzell Cyber Essentials question set asks: "If no, please describe the way that your sites are connected." It is a notes question, answered in free text.
A2.3.2 appears if you answered No to A2.3.1. Describe how sites without their own internet connection reach the internet: for example a site-to-site VPN between firewalls, an MPLS or private circuit, or SD-WAN, and where the internet breakout and boundary firewall sit. Name the equipment at each end so the assessor can match it to A2.5.
No. A2.3.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes, if they are routers or firewalls that control the flow of data to and from the internet. A2.5 asks for all such equipment, with make, model and quantity.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh