Check your readiness
Firewall · Ubiquiti

Ubiquiti UniFi settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to UniFi Network 10, UniFi OS 4.4 and later (paths checked against Ubiquiti Help Center).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

A UniFi gateway meets the Cyber Essentials firewall control when the UI account that owns the console uses MFA, remote management through the Ubiquiti cloud is off or protected by that MFA, port forwards and firewall policies are documented, and UniFi OS, the Network application and device firmware update within 14 days of any critical or high-risk fix.

Key facts
Platform
Ubiquiti UniFi (Dream Machine, Cloud Gateway) (Ubiquiti)
Applies to
UniFi Network 10, UniFi OS 4.4 and later (paths checked against Ubiquiti Help Center)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
10 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Ubiquiti UniFi (Dream Machine, Cloud Gateway) for firewalls?

Apply 4 settings in Ubiquiti UniFi (Dream Machine, Cloud Gateway): enforce MFA on every UI account with console access, decide on cloud remote management, document port forwards and inbound policies and review policies at least annually. Together they provide evidence for A4.11, A7.16, A4.9, A4.10, A4.7, A4.8, A4.5 and A4.6.

A UniFi console can be managed locally or through unifi.ui.com. Remote management through the Ubiquiti cloud is an internet-facing admin route, so it counts under A4.9 and needs MFA under A4.11. See the firewalls requirements for what the control asks.

  1. Enforce MFA on every UI account with console access

    A4.11A7.16AUTO-FAIL
    account.ui.com > Security: add an MFA method (UI Verify or an authenticator app, plus backup codes); UniFi OS > Admins & Users: check every admin signs in with a UI account

  2. Decide on cloud remote management

    A4.9A4.10
    UniFi OS > Settings > Control Plane > Console > Remote Management: untick unless documented (it is switched on by default during setup)

  3. Document port forwards and inbound policies

    A4.7A4.8
    UniFi Network > Settings > Port Forwarding and the Policy Table (under Policy Engine or Zones, depending on your Network version) > give each entry a Name that states its business need

    Built-in policies govern traffic from the External zone, and UniFi adds policies automatically when you create a port forward or VPN server. Each one that lets traffic in from External is an inbound rule to document. Turn UPnP off so devices cannot open ports themselves.

  4. Review policies at least annually

    A4.5A4.6
    UniFi Network > Settings > Policy Table and Zones: check each policy's hit counter, remove unused policies and record the review date

A5: how do you configure Ubiquiti UniFi (Dream Machine, Cloud Gateway) for secure configuration?

Apply 2 settings in Ubiquiti UniFi (Dream Machine, Cloud Gateway): set unique local and device SSH credentials and remove unused administrators. Together they provide evidence for A4.2, A5.3, A5.2 and A7.3.

Change local credentials and remove administrators and services you do not use. See the secure configuration requirements for what the control asks.

  1. Set unique local and device SSH credentials

    A4.2A5.3
    UniFi OS > Admins & Users > local admin > change password; UniFi Network > UniFi Devices > Device Updates and Settings > Device SSH Settings > Device SSH Authentication: set unique credentials

  2. Remove unused administrators

    A5.2A7.3
    UniFi OS > Admins & Users > remove people who no longer administer the network

A6: how do you configure Ubiquiti UniFi (Dream Machine, Cloud Gateway) for security update management?

Apply 2 settings in Ubiquiti UniFi (Dream Machine, Cloud Gateway): turn on automatic updates and track Ubiquiti security advisories. Together they provide evidence for A6.4.1, A6.4 and A6.4.2.

UniFi OS, the Network application and device firmware all update separately. Automatic updates are available for each. See the security update management requirements for what the control asks.

  1. Turn on automatic updates

    A6.4.1A6.4AUTO-FAIL
    UniFi OS > Settings > Control Plane > Updates > select the console and each application > configure auto-update; UniFi Network > UniFi Devices > Device Updates and Settings: turn on automatic device updates

  2. Track Ubiquiti security advisories

    A6.4.2
    community.ui.com > Releases: check the Security Advisory Bulletin posts; record each critical or high advisory and the date the console updated

A7: how do you configure Ubiquiti UniFi (Dream Machine, Cloud Gateway) for user access control?

Apply 1 setting in Ubiquiti UniFi (Dream Machine, Cloud Gateway): one admin per person with a limited role. Together they provide evidence for A7.2, A7.5 and A7.8.

Named admin accounts with roles, rather than one shared login. See the user access control requirements for what the control asks.

  1. One admin per person with a limited role

    A7.2A7.5A7.8
    UniFi OS > Admins & Users > Add Admin: Super Admin only where needed (Ubiquiti treats it as equivalent to the Owner), otherwise a restricted role limited to the Network application

A8: how do you configure Ubiquiti UniFi (Dream Machine, Cloud Gateway) for malware protection?

Apply 1 setting in Ubiquiti UniFi (Dream Machine, Cloud Gateway): enable intrusion prevention and content filtering. Together they provide evidence for A8.3.

Threat management at the gateway supports A8.3 only. Devices still need their own malware protection for A8.1. See the malware protection requirements for what the control asks.

  1. Enable intrusion prevention and content filtering

    A8.3
    UniFi Network > Settings > CyberSecure > Protection > Intrusion Prevention: on, Detection Mode Notify and Block (IPS); Settings > CyberSecure > Content Filter: Filtering Policy Basic or Enhanced

Which questions does this guide cover?

The 19 questions below are the ones Ubiquiti UniFi (Dream Machine, Cloud Gateway) can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A4.10If you answered yes in question A4.9, is there a documented business requirement for this access?A4: Decide on cloud remote management
A4.11If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?A4: Enforce MFA on every UI account with console access
A4.2When you first receive an internet router or hardware firewall device, it may have had a default password on it.A5: Set unique local and device SSH credentials
A4.5Do you have a process to manage your firewall?A4: Review policies at least annually
A4.6Have you reviewed your firewall rules in the last 12 months?A4: Review policies at least annually
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Document port forwards and inbound policies
A4.8Please describe how you approve and document your allowed inbound connections.A4: Document port forwards and inbound policies
A4.9Are your boundary firewalls configured to allow access to their configuration settings over the internet?A4: Decide on cloud remote management
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Remove unused administrators
A5.3Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based authentication requirements of Cyber Essentials?A5: Set unique local and device SSH credentials
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Turn on automatic updates
A6.4.1Are all updates applied for operating systems by enabling auto updates?A6: Turn on automatic updates
A6.4.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?A6: Track Ubiquiti security advisories
A7.16AUTO-FAILHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?A4: Enforce MFA on every UI account with console access
A7.2Are all your user and administrative accounts accessed by entering unique credentials?A7: One admin per person with a limited role
A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?A5: Remove unused administrators
A7.5Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?A7: One admin per person with a limited role
A7.8Do you formally track which users have administrator accounts in your organisation?A7: One admin per person with a limited role
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Enable intrusion prevention and content filtering

What evidence should you keep for the assessor?

Keep the 3 dated records listed below for Ubiquiti UniFi (Dream Machine, Cloud Gateway). They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Screenshot of the Remote Management setting and the list of admins with MFA status.
  • Port forwarding and firewall policy list with names and descriptions.
  • Updates page showing auto-update on and the current UniFi OS, Network and firmware versions.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Yes. Remote management through the Ubiquiti cloud lets anyone with the UI account manage the gateway from the internet, so A4.9 is a yes. Requirements v3.3 then need a documented business need and MFA, or an IP allow list with a properly managed password. Ubiquiti has required MFA on every UI account since 22 July 2024, which meets the MFA option.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources