A5.4: Do you host external services that give access to non-public data?
Do you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?
Source: IASME Cyber Essentials Danzell question set v16.3
A5.4 records whether you run or host an external service that gives users across the internet access to data that should not be public: a VPN server, a mail server, a hosted web application, or a SaaS or PaaS product you provide. Answering Yes is not a fail. It opens A5.5 to A5.7, which check how those logins are protected.
Is A5.4 an automatic fail?
No. A5.4 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Your business might run software that allows staff or customers to access information across the internet to an external service hosted on the internal network, cloud data centre or IaaS cloud service. This could be a VPN server, a mail server, or an internally hosted internet application such as a SaaS or PaaS cloud…
- Requirement enforced
Ensure users are authenticated before allowing them access to organisational data or services.
- Outcome if non-compliant
- Not marked against a requirement; inaccurate details may be returned for correction
- Related questions
- A5.3A5.5Back to the secure configuration control
What does A5.4 ask?
A5.4 asks: “Do you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?”
A5.4 asks whether you run or host external services that provide access to data that shouldn't be made public to users across the internet. The guidance describes software that lets staff or customers reach information across the internet from an external service hosted on your internal network, in a cloud data centre or on an IaaS cloud service: a VPN server, a mail server, or an internally hosted internet application such as a SaaS or PaaS service you provide to customers.
The requirement behind it: ensure users are authenticated before allowing them access to organisational data or services. Cloud services you subscribe to (Microsoft 365, Xero) are not what A5.4 is about; they go in A2.9 and are covered by A7.14 to A7.17. A Yes leads to A5.5, A5.6 and A5.7.
How should you answer A5.4?
A5.4 has no single compliant answer. Answer it accurately for your organisation today; this is what each answer means.
- Answer Yes if you host a VPN, mail server, remote desktop gateway, client portal or any application you provide to customers that holds non-public data.
- Answer No if you only subscribe to third-party cloud services and host nothing that users log in to from the internet.
- Either answer is acceptable; a Yes simply means A5.5 to A5.7 must show those logins are protected.
What mistakes do applicants make with A5.4?
A common mistake with A5.4: answering No while a firewall VPN or remote desktop gateway accepts logins from the internet.
- Forgetting a customer portal or web application you host on IaaS.
- Answering Yes for subscribed SaaS such as Microsoft 365, which belongs in A2.9 instead.
- Answering No and then listing inbound VPN rules in A4.8, which contradicts it.
How do you get A5.4 right?
Work through these steps before you enter A5.4 in the portal:
- List every service you run or host that people log in to from the internet: VPNs, remote desktop gateways, mail servers, client portals and customer-facing apps.
- Check the inbound rules in A4.8 for anything you missed.
- Answer Yes if the list is not empty, then complete A5.5 to A5.7 for each service.
How do assessors check A5.4?
What evidence should you keep for A5.4?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.4:
- A list of every service you host that users log in to from the internet.
Where to go next
- Internet-facingGlossary
- Corporate VPNGlossary
- CE Plus test 1: external scanCyber Essentials Plus
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A5 questions
- A5.2A5.2Yes/NoHave you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?Yes/No
- A5.3A5.3Yes/NoHave you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based a…Yes/No
- A5.5A5.5Options A to EIf yes to question A5.4, which authentication option do you use?Options A to E
- A5.6A5.6NotesDescribe the process in place for changing passwords on your external services when you believe they have been compromised.Notes
Frequently asked questions
A5.4 in the 2026 Danzell Cyber Essentials question set asks: "Do you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?" It is a Yes/No question.
A5.4 records whether you run or host an external service that gives users across the internet access to data that should not be public: a VPN server, a mail server, a hosted web application, or a SaaS or PaaS product you provide. Answering Yes is not a fail. It opens A5.5 to A5.7, which check how those logins are protected.
No. A5.4 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
No. Microsoft 365 is a third-party cloud service you subscribe to, listed in A2.9 and covered by A7.14 to A7.17. A5.4 is about services you run or host yourself.
Yes. A VPN server that users log in to from the internet is one of the examples in IASME's A5.4 guidance.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh