Cyber Essentials firewall requirements (v3.3, 2026)

Does every device need to be behind a firewall?

Yes. Every device in scope, whether a server in a rack or a laptop on a kitchen table, must be protected by a correctly configured firewall. In an office that is usually the boundary firewall or router. Away from the office it is the software firewall built into the operating system.

The NCSC's advice is to turn on the pre-installed firewall in Windows, macOS or Linux rather than buy a third-party product. Question A4.1.1 asks whether software firewalls are enabled on all computers, laptops and servers, and its guidance says the software firewall must be configured and enabled at all times, even when the device sits behind a boundary firewall in the office. A4.1.2 exists only for operating systems that do not ship with one. The IASME guidance for A4.1.2 says only very few do, such as embedded Linux systems or bespoke servers, and that all versions of Windows, macOS and common Linux distributions such as Ubuntu have a software firewall available.

Practical steps: enforce the host firewall centrally rather than device by device (an Intune or Group Policy profile on Windows, a configuration profile on macOS), then export the compliance report as your evidence. The Windows 11 and macOS setup guides show the settings, and the FortiGate, Sophos, DrayTek, Cisco Meraki, UniFi and WatchGuard guides cover common boundary devices.

QuestionsA4.1A4.1.1A4.1.2

Do I have to change the default firewall password?

Yes, on every firewall and router in scope, because a default password is pre-set and often publicly known. The replacement password must meet the password-based authentication rules: MFA with a password of at least 8 characters, a minimum length of at least 12 characters, or at least 8 characters with a deny list of common passwords. Question A4.3 asks which of these options you use; option E ('none of the above') does not pass.

The A4.2 guidance closes two common gaps. Routers and firewalls that arrive with a unique password already printed on them, such as a BT Business Hub or a DrayTek Vigor 2865ac, still need that password changed. And where you rely on the software firewall built into the operating system, the password that needs changing is the one used to access the device.

You also need a process for changing the password when you know or suspect it has been compromised (A4.4), and a written description of how you change it in the first place (A4.2.1). The A4.4 guidance gives the usual triggers: a virus on your system, or the manufacturer notifying you of a security weakness in the product. Home routers not supplied by your organisation are excluded from A4.2.1.

QuestionsA4.2A4.2.1A4.3A4.4

Can the firewall admin interface be reachable from the internet?

Only with a clear and documented business need, and only when the interface is protected by one of two controls: multi-factor authentication, or an IP allow list that limits access to a small range of trusted addresses combined with a properly managed password authentication approach.

In practice most applicants answer No to A4.9 and manage the firewall from inside the network or over a corporate VPN. The A4.9 guidance confirms that if the configuration settings are only reachable through a VPN connection, or you have not opened them to anyone outside the organisation, the answer is No. If you answer Yes, for example because an IT support company changes settings over the internet, A4.10 asks for the documented business requirement and A4.11 asks which of the two protections you use.

QuestionsA4.9A4.10A4.11

What does 'block unauthenticated inbound connections by default' mean?

The firewall's default posture must be deny. Nothing from the internet reaches an internal device unless a rule explicitly allows it, and anything that is allowed must require authentication (a VPN, an authenticated web application) before it hands over data.

Question A4.7 is phrased the other way round: 'Is your firewall configured to allow unauthenticated inbound connections?' The compliant answer is No.

QuestionsA4.7

How should inbound firewall rules be approved and documented?

Each inbound firewall rule needs three things on record: who approved it, when, and the business reason it exists. A change ticket, a firewall change log or a simple spreadsheet all work, provided the entries exist before the rule does. A typical entry reads: 'TCP 443 to the VPN gateway, needed for remote staff access, business case signed off by the managing director on 12 March, next risk review in September'.

Question A4.8 asks you to describe the approval and documentation process. The IASME guidance is specific: the business case must be documented, signed off at board level, and its associated risks reviewed regularly. Typical examples it gives are a VPN server, a mail server, an FTP server or a service your customers reach, sometimes called 'opening a port'. Assessors want to see a named role, not 'IT does it'.

QuestionsA4.8

How often do firewall rules need to be reviewed?

The requirement is to remove or disable rules when they are no longer needed. The question set turns that into a cadence: A4.6 asks whether you have reviewed your firewall rules in the last 12 months and how. A4.5 asks whether you have a process to manage the firewall at all.

A review means someone walks the rule base, confirms each inbound rule still has a business owner and a reason, and disables the rest. The A4.6 guidance asks you to say when services are reviewed, who decides to remove them and who checks that it has been done, so a good answer names all three.

QuestionsA4.5A4.6

Do laptops on public wifi need a software firewall?

Yes. Any device that is used on a network you do not control, including home broadband and public hotspots, must have its software firewall on. Home routers are out of scope, so the software firewall is the only boundary control the scheme can rely on for remote workers. See home and remote working.

QuestionsA4.1.1