Check your readiness
Firewall · Sophos

Sophos Firewall settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to SFOS 21.5 and 22 (paths checked against Sophos documentation).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

A Sophos Firewall meets the Cyber Essentials firewall control when the default admin password is changed, WAN administrative access is disabled or limited by MFA and local service ACL exceptions, inbound rules are deny by default and documented, and SFOS firmware and hotfixes are applied within 14 days of any critical or high-risk fix.

Key facts
Platform
Sophos Firewall (XGS) (Sophos)
Applies to
SFOS 21.5 and 22 (paths checked against Sophos documentation)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
13 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Sophos Firewall (XGS) for firewalls?

Apply 5 settings in Sophos Firewall (XGS): change the default admin password, block admin services on the WAN zone, limit any remaining admin access by IP and require MFA, document inbound rules and review rules at least annually. Together they provide evidence for A4.2, A4.2.1, A4.3, A4.9, A4.10, A4.11, A4.7, A4.8, A4.5 and A4.6.

Questions A4.2 to A4.11 map to the Administration, Authentication and Rules and policies menus. See the firewalls requirements for what the control asks.

  1. Change the default admin password

    A4.2A4.2.1A4.3
    Administration > Device access > Default admin password settings: set a new password; Administration > Admin and user settings > Administrator password complexity settings: Enable password complexity check, minimum length 12

  2. Block admin services on the WAN zone

    A4.9A4.10
    Administration > Device access > Local service ACL > WAN: untick HTTPS (web admin), SSH and User portal unless documented

  3. Limit any remaining admin access by IP and require MFA

    A4.11
    Administration > Device access > Local service ACL exception rule > Add: trusted source IPs only; Authentication > Multi-factor authentication: apply MFA to the web admin console (for the default admin, Administration > Device access > MFA for default admin)

  4. Document inbound rules

    A4.7A4.8
    Rules and policies > Firewall rules and NAT rules > each WAN inbound rule: give it a Rule name that identifies the service, and record the business need, approver and date in your firewall register

  5. Review rules at least annually

    A4.5A4.6
    Rules and policies > Firewall rules > check each rule's usage count and the Unused status; turn off or delete rules you no longer need and record the review

A5: how do you configure Sophos Firewall (XGS) for secure configuration?

Apply 2 settings in Sophos Firewall (XGS): remove unused administrators and disable unused services. Together they provide evidence for A5.2, A7.3 and A5.1.

Remove unused administrator accounts and services on the appliance. See the secure configuration requirements for what the control asks.

  1. Remove unused administrators

    A5.2A7.3
    Authentication > Users > select unused administrator accounts > Change status to inactive, or delete them

  2. Disable unused services

    A5.1
    Administration > Device access > untick services not used on any zone (for example SNMP, unused VPN portals)

A6: how do you configure Sophos Firewall (XGS) for security update management?

Apply 3 settings in Sophos Firewall (XGS): apply firmware updates, allow automatic hotfixes and track Sophos security advisories. Together they provide evidence for A6.4, A6.1, A6.4.1 and A6.4.2.

A6.4 covers firewall firmware. Sophos ships security hotfixes between firmware releases; let them install automatically and upgrade firmware within 14 days of a critical or high-risk advisory. See the security update management requirements for what the control asks.

  1. Apply firmware updates

    A6.4AUTO-FAILA6.1
    Backup & firmware > Firmware: check for and install the latest supported release

  2. Allow automatic hotfixes

    A6.4.1
    Backup & firmware > Firmware > Hotfix > Allow automatic installation of hotfixes: On

  3. Track Sophos security advisories

    A6.4.2
    sophos.com/security-advisories: check at least weekly; record each critical or high advisory and the date you patched

A7: how do you configure Sophos Firewall (XGS) for user access control?

Apply 2 settings in Sophos Firewall (XGS): one account per administrator with a profile and set login lockout. Together they provide evidence for A7.2, A7.5, A7.8 and A7.10.

Named administrator accounts with least-privilege profiles, and login lockout. See the user access control requirements for what the control asks.

  1. One account per administrator with a profile

    A7.2A7.5A7.8
    Authentication > Users > Add > User type: Administrator > Profile: Administrator only where needed, otherwise a custom profile with read-only access

  2. Set login lockout

    A7.10
    Administration > Admin and user settings > Login security > Block login: 5 failed attempts from the same IP address within 60 seconds, block for at least 5 minutes

A8: how do you configure Sophos Firewall (XGS) for malware protection?

Apply 1 setting in Sophos Firewall (XGS): apply web protection to outbound rules. Together they provide evidence for A8.3.

Gateway scanning supports A8.3, but endpoints still need their own protection for A8.1. See the malware protection requirements for what the control asks.

  1. Apply web protection to outbound rules

    A8.3
    Rules and policies > Firewall rules > LAN to WAN rule > Web filtering: Web policy: select a policy; Scan HTTP and decrypted HTTPS: on

Which questions does this guide cover?

The 22 questions below are the ones Sophos Firewall (XGS) can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A4.10If you answered yes in question A4.9, is there a documented business requirement for this access?A4: Block admin services on the WAN zone
A4.11If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?A4: Limit any remaining admin access by IP and require MFA
A4.2When you first receive an internet router or hardware firewall device, it may have had a default password on it.A4: Change the default admin password
A4.2.1Please describe the process for changing your firewall password.A4: Change the default admin password
A4.3How is your firewall password configured?A4: Change the default admin password
A4.5Do you have a process to manage your firewall?A4: Review rules at least annually
A4.6Have you reviewed your firewall rules in the last 12 months?A4: Review rules at least annually
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Document inbound rules
A4.8Please describe how you approve and document your allowed inbound connections.A4: Document inbound rules
A4.9Are your boundary firewalls configured to allow access to their configuration settings over the internet?A4: Block admin services on the WAN zone
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A5: Disable unused services
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Remove unused administrators
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A6: Apply firmware updates
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Apply firmware updates
A6.4.1Are all updates applied for operating systems by enabling auto updates?A6: Allow automatic hotfixes
A6.4.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?A6: Track Sophos security advisories
A7.10Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?A7: Set login lockout
A7.2Are all your user and administrative accounts accessed by entering unique credentials?A7: One account per administrator with a profile
A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?A5: Remove unused administrators
A7.5Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?A7: One account per administrator with a profile
A7.8Do you formally track which users have administrator accounts in your organisation?A7: One account per administrator with a profile
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Apply web protection to outbound rules

What evidence should you keep for the assessor?

Keep the 4 dated records listed below for Sophos Firewall (XGS). They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Local service ACL screenshot showing the WAN zone settings.
  • Firewall and NAT rule export with descriptions.
  • Multi-factor authentication settings for the web admin console.
  • Firmware version and hotfix history.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Only if the web admin console is reachable from the internet. If HTTPS admin is unticked for the WAN zone, A4.9 is a no and A4.10 and A4.11 do not apply. If it must stay open, document the business need and protect it with one-time password MFA or a local service ACL exception limited to trusted IP addresses.

They cover the fixes Sophos ships as hotfixes, which is most urgent security work. Firmware releases still need installing yourself. Check Backup & firmware monthly and after each Sophos advisory, and keep the upgrade dates as evidence for A6.4.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources