A2.5: Which firewalls and routers are in scope?
Please provide a list of network equipment that will be in scope for this assessment (including firewalls and routers). You must include make, model and quantity of each device listed.
Source: IASME Cyber Essentials Danzell question set v16.3
A2.5 needs the make, model and quantity of every router and firewall that controls the flow of data between your networks and the internet, including virtual and cloud firewalls and routers you supply to home workers. Switches and access points that do not route internet traffic are not needed.
Is A2.5 an automatic fail?
No. A2.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You should include all equipment that controls the flow of data to and from the internet. This will be your routers and firewalls.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.5 ask?
A2.5 asks: “Please provide a list of network equipment that will be in scope for this assessment (including firewalls and routers). You must include make, model and quantity of each device listed.”
A2.5 asks for a list of network equipment in scope, including firewalls and routers, with the make, model and quantity of each. The guidance says to include all equipment that controls the flow of data to and from the internet, and that you do not need to include switches or wireless access points that do not contain a firewall or route internet traffic.
It also says: if you have home or remote workers, they rely on software firewalls, so give details in the notes; you are not required to list IP addresses, MAC addresses or serial numbers; and details of routers and firewalls in the home environment must not be included unless you supplied them.
Every device you list here must meet the firewall requirements in section A4 and run supported firmware under A6.1, which counts firmware as an operating system. Platform guides: FortiGate, Sophos Firewall, DrayTek, Meraki, UniFi, WatchGuard.
What should you write in the notes field for A2.5?
Write two to four specific sentences for A2.5: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
1 x Fortinet FortiGate 60F (head office boundary firewall, FortiOS [version]). 1 x DrayTek Vigor 2865 (branch office router and firewall, firmware [version]). [1 x ISP router in modem-only mode at head office.] Azure: [n] x Azure Firewall / network security policies for the IaaS subscription in A2.9. Home workers ([n]) rely on the software firewall on their devices (Windows Defender Firewall and macOS firewall), enforced by [Intune / Jamf].
Why do applicants fail A2.5?
A common reason applicants fail A2.5: leaving out the ISP router when it still performs routing or firewalling in front of, or instead of, your own firewall.
- Forgetting cloud firewalls protecting IaaS servers.
- Listing workers' own home routers, which the guidance says must not be included.
- A device with end-of-life firmware, which then contradicts A6.1 and A6.4.
How do you fix a failing A2.5 answer?
If your answer to A2.5 would not pass today, fix the control first and then write the answer. In order:
- Export or note the make, model and quantity of every router and firewall that routes or filters internet traffic, including ISP routers, backup mobile routers, virtual and cloud firewalls, and routers you supply to home workers.
- Leave out switches and access points that do not route internet traffic, and home routers you did not supply.
- Check each model is still supported by the vendor and on current firmware (A6.1, A6.4).
- Add a note that home workers rely on software firewalls, if they do.
How do assessors check A2.5?
What evidence should you keep for A2.5?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.5:
- An export or screenshot of each firewall's model and firmware version.
- The vendor's support status page for each model.
Where to go next
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- FirmwareGlossary
- RouterGlossary
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.4.1A2.4.1NotesHow many staff are home or remote workers?Notes
- A2.4.2A2.4.2NotesHow are home/remote workers connecting to your organisational data and services?Notes
- A2.5.1A2.5.1NotesIf you are certifying as partial organisation, please list the equipment used to create any sub-sets.Notes
- A2.6A2.6NotesPlease list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.Notes
Frequently asked questions
A2.5 in the 2026 Danzell Cyber Essentials question set asks: "Please provide a list of network equipment that will be in scope for this assessment (including firewalls and routers). You must include make, model and quantity of each device listed." It is a notes question, answered in free text.
A2.5 needs the make, model and quantity of every router and firewall that controls the flow of data between your networks and the internet, including virtual and cloud firewalls and routers you supply to home workers. Switches and access points that do not route internet traffic are not needed.
No. A2.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No, unless they contain a firewall or route internet traffic. IASME's A2.5 guidance limits the list to equipment that controls the flow of data to and from the internet.
Yes, if it routes or filters internet traffic for your network. If it is in modem or bridge mode behind your own firewall, say so in the notes.
No. IASME's guidance says you are not required to list IP addresses, MAC addresses or serial numbers. Make, model and quantity are required.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh