Check your readiness
Firewall · DrayTek

DrayTek router settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to Vigor 2865 and 2927, firmware 4.4 and later (paths checked against DrayTek documentation).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

A DrayTek Vigor router meets the Cyber Essentials firewall control when the admin password is changed from the default, management from the internet is switched off or limited to trusted IP addresses, open ports and port redirections are documented, the model is still supported, and firmware is applied within 14 days of any critical or high-risk fix.

Key facts
Platform
DrayTek Vigor (DrayTek)
Applies to
Vigor 2865 and 2927, firmware 4.4 and later (paths checked against DrayTek documentation)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
12 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure DrayTek Vigor for firewalls?

Apply 5 settings in DrayTek Vigor: change the admin password, disable management from the internet, restrict any remaining management to trusted IPs, document open ports and port redirection and check the firewall default action and review rules. Together they provide evidence for A4.2, A4.2.1, A4.3, A4.9, A4.10, A4.11, A4.7, A4.8, A4.5 and A4.6.

DrayTek routers are common in small offices and are often both router and boundary firewall. The internet management setting is the first thing to check: DrayTek's 3 October 2025 advisory for CVE-2025-10547 (rated critical) told owners to disable remote management and SSL VPN, enable the access list, and update firmware. See the firewalls requirements for what the control asks.

  1. Change the admin password

    A4.2A4.2.1A4.3
    System Maintenance > Administrator Password (Admin Password on some models): enter the old password, then a unique new password of at least 12 characters

  2. Disable management from the internet

    A4.9
    System Maintenance > Management > Internet Access Control > Allow management from the Internet: untick (it is off by default); if it must stay on, tick only the services you need

  3. Restrict any remaining management to trusted IPs

    A4.10A4.11
    System Maintenance > Management > Access List: enable it and add only trusted IP addresses or IP objects

    Record the business need for remote management. A trusted IP list must be combined with a properly managed password to meet A4.11.

  4. Document open ports and port redirection

    A4.7A4.8
    NAT > Port Redirection and NAT > Open Ports > keep a record of each entry with the business need, approver and date

  5. Check the firewall default action and review rules

    A4.5A4.6A4.7
    NAT > DMZ Host: confirm it is off; Firewall > General Setup: record the Default Rule; Firewall > Filter Setup: review each rule at least annually

A5: how do you configure DrayTek Vigor for secure configuration?

Apply 1 setting in DrayTek Vigor: turn off unused services. Together they provide evidence for A5.1.

Disable services you do not use, especially those reachable from the WAN. See the secure configuration requirements for what the control asks.

  1. Turn off unused services

    A5.1
    System Maintenance > Management: untick Telnet, FTP and any other management services you do not use; System Maintenance > TR-069: disable unless your ISP manages the router; VPN and Remote Access > Remote Access Control: untick unused VPN types

A6: how do you configure DrayTek Vigor for security update management?

Apply 3 settings in DrayTek Vigor: check and apply firmware, confirm the model is still supported and subscribe to DrayTek security advisories. Together they provide evidence for A6.4, A6.4.2 and A6.1.

Firmware updates are manual on most Vigor models. A6.4 names router firmware, so the 14-day rule applies. See the security update management requirements for what the control asks.

  1. Check and apply firmware

    A6.4AUTO-FAILA6.4.2A6.1
    System Maintenance > Firmware Upgrade: install the latest release for your exact model, downloaded from the DrayTek support site

  2. Confirm the model is still supported

    A6.1
    draytek.co.uk > Support > Product Lifecycle: check the End of Life date for your model (the last date DrayTek guarantees critical security updates)

    An end-of-life model receives no firmware fixes and fails A6.1. Replace it before you apply.

  3. Subscribe to DrayTek security advisories

    A6.4.2
    draytek.co.uk > Support > Security Advisories: check at least weekly; log each advisory, its priority and the date you upgraded

A7: how do you configure DrayTek Vigor for user access control?

Apply 2 settings in DrayTek Vigor: create individual admin users and enable login brute-force protection. Together they provide evidence for A7.2, A7.8 and A7.10.

Named admin accounts where the firmware supports them, and brute-force protection on the login page. See the user access control requirements for what the control asks.

  1. Create individual admin users

    A7.2A7.8
    System Maintenance > Administrator Password: create a separate local administrator account for each person where your model and firmware support it

  2. Enable login brute-force protection

    A7.10
    System Maintenance > Management > Brute Force Protection: enable for each management service; Maximum Login Failures: 10 or fewer; set a Penalty Period

A8: how do you configure DrayTek Vigor for malware protection?

Apply 1 setting in DrayTek Vigor: enable DNS filtering where licensed. Together they provide evidence for A8.3.

A Vigor router is not a gateway anti-malware device. Endpoint protection on the devices behind it is still required for A8.1. See the malware protection requirements for what the control asks.

  1. Enable DNS filtering where licensed

    A8.3
    CSM > DNS Filter Profile > block malware and phishing categories

Which questions does this guide cover?

The 18 questions below are the ones DrayTek Vigor can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A4.10If you answered yes in question A4.9, is there a documented business requirement for this access?A4: Restrict any remaining management to trusted IPs
A4.11If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?A4: Restrict any remaining management to trusted IPs
A4.2When you first receive an internet router or hardware firewall device, it may have had a default password on it.A4: Change the admin password
A4.2.1Please describe the process for changing your firewall password.A4: Change the admin password
A4.3How is your firewall password configured?A4: Change the admin password
A4.5Do you have a process to manage your firewall?A4: Check the firewall default action and review rules
A4.6Have you reviewed your firewall rules in the last 12 months?A4: Check the firewall default action and review rules
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Document open ports and port redirection; A4: Check the firewall default action and review rules
A4.8Please describe how you approve and document your allowed inbound connections.A4: Document open ports and port redirection
A4.9Are your boundary firewalls configured to allow access to their configuration settings over the internet?A4: Disable management from the internet
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A5: Turn off unused services
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A6: Check and apply firmware; A6: Confirm the model is still supported
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Check and apply firmware
A6.4.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?A6: Check and apply firmware; A6: Subscribe to DrayTek security advisories
A7.10Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?A7: Enable login brute-force protection
A7.2Are all your user and administrative accounts accessed by entering unique credentials?A7: Create individual admin users
A7.8Do you formally track which users have administrator accounts in your organisation?A7: Create individual admin users
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Enable DNS filtering where licensed

What evidence should you keep for the assessor?

Keep the 4 dated records listed below for DrayTek Vigor. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Screenshot of System Maintenance > Management > Internet Access Control.
  • Firmware version, the release notes it fixed and the upgrade date.
  • Open ports and port redirection tables with the business need for each entry.
  • Confirmation the model is not on the end-of-life list.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Yes, if it is the boundary firewall for an office in scope. The router at each site is listed in A2.5 and must meet A4. If the ISP manages it, ask them for evidence that the default password is changed, remote management is restricted and firmware is current, and keep that with your notes.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources