Cyber Essentials wireless devices and access points scope
Wireless access points are in scope if they can communicate with other devices via the internet, and out of scope if an attacker cannot reach them directly over the internet or they are part of an ISP router at home.
Cyber Essentials puts wireless devices, including access points, in scope if they can communicate with other devices via the internet. They are out of scope if they cannot be attacked directly from the internet, since attacks launched only within signal range are not the scheme's concern, or if they are part of an ISP router at a home location.
- In scope
- Wireless devices that can communicate with other devices via the internet
- Out of scope
- Devices an attacker cannot reach directly via the internet; devices that are part of an ISP router at the home or remote location
- Rationale
- The scheme isn’t concerned with attacks that can only be launched within the signal range of the wireless device
- Question
- A2.5 lists network equipment that controls internet traffic: make, model and quantity. Switches and access points without a firewall or internet routing are not listed
- Source
- Requirements for IT Infrastructure v3.3, Section D(iii), Wireless devices
When is an access point in or out of scope?
The requirements set out three rules for wireless devices, including wireless access points:
- in scope if they can communicate with other devices via the internet
- out of scope if it's not possible for an attacker to attack directly via the internet (the Cyber Essentials scheme isn’t concerned with attacks that can only be launched within the signal range of the wireless device)
- out of scope if they are part of an ISP router at the home or remote location
What does that mean for a typical office?
An access point sitting behind your boundary firewall with no inbound access from the internet is out of scope for the wireless rules, but the firewall in front of it is in scope. A cloud-managed access point whose management plane is reachable from the internet, or a combined router and access point that is your internet boundary, is in scope and must meet the firewall and security update controls.
Wireless security settings such as WPA2 or WPA3 are not assessed by Cyber Essentials. The scheme's threat model is the internet-based attacker.
Do I list access points in A2.5?
A2.5 asks for the make, model and quantity of network equipment in scope, including firewalls and routers. The IASME guidance says to include all equipment that controls the flow of data to and from the internet, and that you do not need to include switches or wireless access points that do not contain a firewall or do not route internet traffic. So list an access point only if it routes internet traffic or has its own firewall, for example a combined router and access point at a small office.
Two further rules from the A2.5 guidance: details of routers and firewalls in the home environment must not be included, and you are not required to list IP addresses, MAC addresses or serial numbers. See the guest wifi and WPA2 and WPA3 glossary entries for the wireless settings that sit outside the scheme.
How do assessors check this?
Related requirements
Frequently asked questions
No. The scheme is not concerned with attacks that can only be launched within the signal range of a wireless device, so wifi encryption and passphrases are not assessed. Good practice still says use WPA2 or WPA3 and a strong passphrase.
No. Wireless devices that are part of an ISP router at the home or remote location are out of scope. The worker's laptop is in scope and must run a software firewall instead.
If the access point can communicate with other devices via the internet, for example through a management plane reachable from the internet, it is in scope. Its firmware must be supported and critical fixes applied within 14 days, and its admin access must meet the firewall control.
A guest network can only be kept out of scope as a sub-set, segregated by a firewall or VLAN; the A2.2.2 guidance says security groups, microsegmentation and software-based methods are not compliant. Excluding networks this way is a partial scope, declared at A2.1 and described in A2.2.1 and A2.2.2. The device that enforces the separation stays in scope.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh