A2.4.2: How do home and remote workers connect?
How are home/remote workers connecting to your organisational data and services?
Source: IASME Cyber Essentials Danzell question set v16.3
A2.4.2 asks how home and remote workers reach your organisational data and services: through their own home router, a router your organisation supplied, or a corporate VPN, and often straight to cloud services. State each method in use and what provides the firewall control in each case, because that decides which device the firewall requirements apply to.
Is A2.4.2 an automatic fail?
No. A2.4.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- For example, via home router, business-provided router or corporate VPN.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.4.2 ask?
A2.4.2 asks: “How are home/remote workers connecting to your organisational data and services?”
A2.4.2 asks how home and remote workers are connecting to your organisational data and services. The guidance gives three examples: via home router, business-provided router, or corporate VPN.
The v3.3 rules follow from the answer. A home router the worker owns is out of scope, so the device's software firewall must be on (A4.1.1). A router you supply is in scope and goes in A2.5. A corporate VPN moves the worker's internet boundary to the company firewall or a virtual or cloud firewall, which you must administer so you can apply the firewall controls. See corporate VPN.
What should you write in the notes field for A2.4.2?
Write two to four specific sentences for A2.4.2: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Home workers connect over their own home broadband directly to Microsoft 365 and the cloud services in A2.9. Each laptop's software firewall ([Windows Defender Firewall / macOS firewall]) is enforced on all network profiles through [Intune / Jamf] and cannot be disabled by users. [n] staff use an organisation-supplied [make and model] router, listed in A2.5. [We do not use a VPN / A corporate VPN to the head office FortiGate is used for access to the file server.]
Why do applicants fail A2.4.2?
A common reason applicants fail A2.4.2: answering 'VPN' when the VPN is split tunnel and only covers some traffic, leaving the device's own firewall as the real control.
- Relying on the home router's firewall, which is out of scope and cannot be counted.
- A third-party consumer VPN service, which is not a corporate VPN you administer.
- No mention of how the software firewall is enforced on remote devices.
How do you fix a failing A2.4.2 answer?
If your answer to A2.4.2 would not pass today, fix the control first and then write the answer. In order:
- List each connection method in use: own home broadband, an organisation-supplied router, or a corporate VPN.
- For each, name what provides the firewall control: the device's software firewall, the supplied router (listed in A2.5) or the company or cloud firewall the VPN connects to.
- Enforce the software firewall by MDM so it cannot be turned off.
How do assessors check A2.4.2?
What evidence should you keep for A2.4.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.4.2:
- The software firewall policy applied to remote devices, and the VPN configuration if you use one.
Where to go next
- Home and remote workingVPNs and software firewalls
- Corporate VPNGlossary
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.4A2.4NotesPlease provide a list of networks that will be in scope for this assessment.Notes
- A2.4.1A2.4.1NotesHow many staff are home or remote workers?Notes
- A2.5A2.5NotesPlease provide a list of network equipment that will be in scope for this assessment (including firewalls and routers).Notes
- A2.5.1A2.5.1NotesIf you are certifying as partial organisation, please list the equipment used to create any sub-sets.Notes
Frequently asked questions
A2.4.2 in the 2026 Danzell Cyber Essentials question set asks: "How are home/remote workers connecting to your organisational data and services?" It is a notes question, answered in free text.
A2.4.2 asks how home and remote workers reach your organisational data and services: through their own home router, a router your organisation supplied, or a corporate VPN, and often straight to cloud services. State each method in use and what provides the firewall control in each case, because that decides which device the firewall requirements apply to.
No. A2.4.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. v3.3 does not require a VPN. Without one, the device's software firewall provides the firewall control, because home routers you did not supply are out of scope.
No. The v3.3 definition is a VPN that connects back to your office location or to a virtual or cloud firewall, administered by you so you can apply the firewall controls.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh