Cyber Essentials home and remote working scope

Are home workers' devices in scope?

Yes. The NCSC's default approach is that all corporate or BYOD home or remote working devices used for your organisation's business are in scope. A2.4.1 asks how many staff are home or remote workers; the guidance treats anyone permitted to work away from the office as a remote worker, not only those who do so full time.

Is the home router in scope?

Only if your organisation gave it to the worker. All other routers are out of scope, which means you need to apply Cyber Essentials firewall controls, such as a software firewall, on the user devices themselves. This is why A4.1.1 (software firewalls enabled on all computers, laptops and servers) matters so much for remote-first organisations.

What changes if remote workers use a corporate VPN?

A corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and you must administer it so that you can apply the firewall controls. When a home worker uses one, their internet boundary is on the company firewall or virtual or cloud firewall, so that firewall's configuration is what the assessor examines. Split-tunnel VPNs still leave the device exposed on the local network, so keep the software firewall on regardless.

How should I answer A2.4.2?

Describe each route: 'Staff use company laptops with Windows Defender Firewall enabled and connect to Microsoft 365 directly over the internet with MFA; access to the on-premises file server is through an always-on corporate VPN terminating on the office firewall.' Name the VPN product and say whether it is always on or user-initiated. The A2.4.2 guidance expects one of three routes, or a mix: the home router, a business-provided router, or a corporate VPN.

The A2.4.2 answer should agree with A2.5, whose guidance says home and remote workers rely on software firewalls and asks you to give details in the notes field, while details of routers and firewalls in the home environment must not be listed.

What evidence should I keep for home and remote workers?

A count of everyone permitted to work remotely, the device each uses, the policy or compliance report showing the software firewall enforced on every laptop, the corporate VPN configuration if you use one, and a list of any routers your organisation supplied to home workers, since those are in scope and must meet the firewall control. The Windows 11 and macOS setup guides show how to enforce the host firewall.