Check your readiness
Firewall · Cisco

Cisco Meraki settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to Current MX stable firmware, Meraki Dashboard (paths checked against Meraki documentation).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

A Meraki MX meets the Cyber Essentials firewall control when every Dashboard account uses two-factor authentication, local status page access is disabled or uses a unique password, inbound port forwards and firewall rules are documented and reviewed, and MX firmware is upgraded within 14 days of any critical or high-risk fix.

Key facts
Platform
Cisco Meraki MX (Cisco)
Applies to
Current MX stable firmware, Meraki Dashboard (paths checked against Meraki documentation)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
11 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Cisco Meraki MX for firewalls?

Apply 5 settings in Cisco Meraki MX: require two-factor authentication on Dashboard, limit Dashboard logins to trusted IP ranges, disable or protect the local status page, document inbound rules and port forwards and review rules at least annually. Together they provide evidence for A4.11, A7.16, A4.2, A4.3, A4.7, A4.8, A4.5 and A4.6.

Meraki is cloud-managed, so the administrative interface you protect is the Dashboard rather than a WAN-facing web page. Dashboard is reachable from the internet, so treat it as A4.9 answered yes and protect it with MFA for A4.11. See the firewalls requirements for what the control asks.

  1. Require two-factor authentication on Dashboard

    A4.11A7.16AUTO-FAIL
    Organization > Configure > Settings > Security Settings > Two-factor authentication: force all users in the organization to set up and use two-factor authentication

  2. Limit Dashboard logins to trusted IP ranges

    A4.11
    Organization > Configure > Settings > Security Settings > Login IP ranges: restrict Dashboard and API access to office and VPN egress addresses

  3. Disable or protect the local status page

    A4.2A4.3
    Network-wide > Configure > General > Device configuration: turn the local status page off, or set a strong local credentials password

    Older networks use the device serial number as the default local status page password. On a device with a physical management port, that port stays active whatever this setting says.

  4. Document inbound rules and port forwards

    A4.7A4.8
    Security & SD-WAN > Configure > Firewall > Port forwarding and 1:1 NAT rules > Description: business need, approver and date; set Allowed remote IPs to specific addresses rather than Any where you can

  5. Review rules at least annually

    A4.5A4.6
    Security & SD-WAN > Configure > Firewall: screenshot or export the rules; Organization > Monitor > Change log as review evidence

A5: how do you configure Cisco Meraki MX for secure configuration?

Apply 1 setting in Cisco Meraki MX: remove unused Dashboard administrators. Together they provide evidence for A5.2 and A7.3.

Remove Dashboard administrators who no longer need access. See the secure configuration requirements for what the control asks.

  1. Remove unused Dashboard administrators

    A5.2A7.3
    Organization > Configure > Administrators: remove accounts for people who no longer have a role, checking each account's last activity

A6: how do you configure Cisco Meraki MX for security update management?

Apply 2 settings in Cisco Meraki MX: keep MX firmware current and confirm the MX model is still supported. Together they provide evidence for A6.4, A6.4.1 and A6.1.

Meraki schedules firmware upgrades from the Dashboard. Do not let a security release sit in the schedule for longer than 14 days. See the security update management requirements for what the control asks.

  1. Keep MX firmware current

    A6.4AUTO-FAILA6.4.1
    Organization > Monitor > Firmware upgrades > Scheduled changes: reschedule security releases to within 14 days; Network-wide > Configure > General > Firmware upgrades

  2. Confirm the MX model is still supported

    A6.1
    Meraki documentation > Meraki End-of-Life (EOL) Products and Dates: check the end-of-support (EOST) date for each MX model

A7: how do you configure Cisco Meraki MX for user access control?

Apply 2 settings in Cisco Meraki MX: least-privilege admin roles and turn on Dashboard account lockout. Together they provide evidence for A7.5, A7.8 and A7.10.

Dashboard administrators are administrative accounts. Give each person their own login with the least access they need. See the user access control requirements for what the control asks.

  1. Least-privilege admin roles

    A7.5A7.8
    Organization > Configure > Administrators > Add admin > Organization access: Read-only or None, with network-level access only where full access is not needed

  2. Turn on Dashboard account lockout

    A7.10
    Organization > Configure > Settings > Security Settings > Account lockout: lock accounts after 10 or fewer wrong password attempts

A8: how do you configure Cisco Meraki MX for malware protection?

Apply 1 setting in Cisco Meraki MX: enable malware protection and content filtering. Together they provide evidence for A8.3.

Advanced Security licences add malware protection and content filtering at the gateway. They support A8.3; devices still need their own protection for A8.1. See the malware protection requirements for what the control asks.

  1. Enable malware protection and content filtering

    A8.3
    Security & SD-WAN > Configure > Threat protection > Advanced Malware Protection (AMP): Mode Enabled; Security & SD-WAN > Configure > Content filtering: block malicious and phishing categories

Which questions does this guide cover?

The 17 questions below are the ones Cisco Meraki MX can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A4.11If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?A4: Require two-factor authentication on Dashboard; A4: Limit Dashboard logins to trusted IP ranges
A4.2When you first receive an internet router or hardware firewall device, it may have had a default password on it.A4: Disable or protect the local status page
A4.3How is your firewall password configured?A4: Disable or protect the local status page
A4.5Do you have a process to manage your firewall?A4: Review rules at least annually
A4.6Have you reviewed your firewall rules in the last 12 months?A4: Review rules at least annually
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Document inbound rules and port forwards
A4.8Please describe how you approve and document your allowed inbound connections.A4: Document inbound rules and port forwards
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Remove unused Dashboard administrators
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A6: Confirm the MX model is still supported
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Keep MX firmware current
A6.4.1Are all updates applied for operating systems by enabling auto updates?A6: Keep MX firmware current
A7.10Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?A7: Turn on Dashboard account lockout
A7.16AUTO-FAILHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?A4: Require two-factor authentication on Dashboard
A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?A5: Remove unused Dashboard administrators
A7.5Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?A7: Least-privilege admin roles
A7.8Do you formally track which users have administrator accounts in your organisation?A7: Least-privilege admin roles
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Enable malware protection and content filtering

What evidence should you keep for the assessor?

Keep the 4 dated records listed below for Cisco Meraki MX. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Organization > Configure > Settings > Security Settings showing two-factor required, login IP ranges and account lockout.
  • Firewall, port forwarding and 1:1 NAT rule export with descriptions.
  • Administrator list with access levels.
  • Firmware upgrade history and the current MX version.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Yes. Dashboard is reached over the internet, so treat A4.9 as yes, document the business need for A4.10 (cloud management is the product's design), and protect it under A4.11 with enforced two-factor authentication or login IP ranges. Enforcing both is the cleanest answer.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources