A2.4.1: How many staff are home or remote workers?
How many staff are home or remote workers?
Source: IASME Cyber Essentials Danzell question set v16.3
A2.4.1 needs the number of staff who work from home or remotely. Anyone with permission to work remotely, for any period at the time of the assessment, counts. Their devices are in scope, and unless you supply their router or they use a corporate VPN, those devices rely on software firewalls.
Is A2.4.1 an automatic fail?
No. A2.4.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Any employee that has been given permission to work remotely (for any period at the time of the assessment) needs to be classed as a home/remote worker for Cyber Essentials. For further guidance see the Home and Remote Working section in the Requirements document.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.4.1 ask?
A2.4.1 asks: “How many staff are home or remote workers?”
A2.4.1 asks how many staff are home or remote workers. The guidance says any employee who has been given permission to work remotely, for any period at the time of the assessment, needs to be classed as a home or remote worker, and points to the home and remote working section of the requirements.
Under v3.3 all corporate or BYOD devices used for home or remote working are in scope. If you give a home worker a router, that router is in scope. All other home routers are out of scope, so the firewall control must be met on the device itself, typically with its software firewall. If the worker uses a corporate VPN, their internet boundary is the company firewall. See home and remote working.
What should you write in the notes field for A2.4.1?
Write two to four specific sentences for A2.4.1: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[n] of [total from A1.3] staff are permitted to work from home or remotely, [n] of them full-time and [n] on a hybrid pattern. They use [organisation-issued laptops / BYOD devices], protected by [Windows Defender Firewall / the macOS firewall] enforced through [Intune / Jamf]. [n] use an organisation-supplied router, listed in A2.5.
Why do applicants fail A2.4.1?
A common reason applicants fail A2.4.1: counting only full-time home workers when hybrid staff also have permission to work remotely.
- Answering zero when staff check email on personal phones from home.
- Not reflecting home workers in A2.5's notes about software firewalls.
- Listing home routers you did not supply, which A2.5 guidance says must not be included.
How do you fix a failing A2.4.1 answer?
If your answer to A2.4.1 would not pass today, fix the control first and then write the answer. In order:
- Count everyone with permission to work remotely for any period, including hybrid staff.
- Check that every one of their devices appears in A2.6 or A2.8.
- Confirm each remote device has its software firewall enforced (A4.1.1), unless you supply its router or it uses a corporate VPN.
How do assessors check A2.4.1?
What evidence should you keep for A2.4.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.4.1:
- The list of staff permitted to work remotely, from HR or the remote working policy.
Where to go next
- Home and remote workingWhich routers are in scope
- Software firewallGlossary
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.3.2A2.3.2NotesIf no, please describe the way that your sites are connected.Notes
- A2.4A2.4NotesPlease provide a list of networks that will be in scope for this assessment.Notes
- A2.4.2A2.4.2NotesHow are home/remote workers connecting to your organisational data and services?Notes
- A2.5A2.5NotesPlease provide a list of network equipment that will be in scope for this assessment (including firewalls and routers).Notes
Frequently asked questions
A2.4.1 in the 2026 Danzell Cyber Essentials question set asks: "How many staff are home or remote workers?" It is a notes question, answered in free text.
A2.4.1 needs the number of staff who work from home or remotely. Anyone with permission to work remotely, for any period at the time of the assessment, counts. Their devices are in scope, and unless you supply their router or they use a corporate VPN, those devices rely on software firewalls.
No. A2.4.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. IASME's A2.4.1 guidance says any employee given permission to work remotely, for any period at the time of the assessment, is classed as a home or remote worker.
Only if your organisation supplied them. Under v3.3 all other home routers are out of scope, so devices must be protected by their software firewalls instead.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh