WatchGuard Firebox settings for Cyber Essentials
Five controls, in scheme order, with the setting path and question number for every step. Applies to Fireware 2026.1 and 12.11 (paths checked against WatchGuard Help Center).
A WatchGuard Firebox meets the Cyber Essentials firewall control when the default admin and status passphrases are changed, management from the External interface is removed or limited to trusted IP addresses with MFA, inbound policies are documented, and Fireware is updated within 14 days of any critical or high-risk fix.
- Platform
- WatchGuard Firebox (WatchGuard)
- Applies to
- Fireware 2026.1 and 12.11 (paths checked against WatchGuard Help Center)
- Paths last checked
- 2026-11
- Controls covered
- Firewalls, Secure configuration, Security update management, User access control, Malware protection
- Questions
- A4.10A4.11A4.2A4.2.1A4.3A4.5A4.6A4.7A4.8A4.9A5.1A5.2A6.1A6.4AUTO-FAILA6.4.2A7.10A7.2A7.3A7.5A7.8A8.3
- Steps
- 12 settings across 5 controls
- Reviewed against
- Requirements v3.3 and the Danzell question set v16.3
A4: how do you configure WatchGuard Firebox for firewalls?
Apply 5 settings in WatchGuard Firebox: change the default passphrases, keep management off the External interface, enable MFA for administrators, document inbound policies and review policies at least annually. Together they provide evidence for A4.2, A4.2.1, A4.3, A4.9, A4.10, A4.11, A4.7, A4.8, A4.5 and A4.6.
Fireware Web UI and WatchGuard Cloud policies map to A4.2 to A4.11. A new Firebox ships with the passphrases readwrite (admin) and readonly (status), which A4.2 requires you to change. See the firewalls requirements for what the control asks.
Enable MFA for administrators
A4.11AuthPoint: add a Firebox resource; Fireware Web UI > System > Users and Roles > Add: select AuthPoint as the authentication server (Fireware v12.7 or higher)
A5: how do you configure WatchGuard Firebox for secure configuration?
Apply 2 settings in WatchGuard Firebox: remove unused users and remove unused service policies. Together they provide evidence for A5.2, A7.3 and A5.1.
Remove unused admin accounts and policies for services you do not run. See the secure configuration requirements for what the control asks.
Remove unused service policies
A5.1Firewall > Firewall Policies > disable or delete policies for services you no longer use (for example old FTP or RDP policies)
A6: how do you configure WatchGuard Firebox for security update management?
Apply 2 settings in WatchGuard Firebox: upgrade Fireware OS and track WatchGuard PSIRT advisories. Together they provide evidence for A6.4, A6.1 and A6.4.2.
A6.4 names firewall firmware. Since the Fireware 2026.1 release, WatchGuard Cloud can flag Fireboxes running a Fireware version affected by known vulnerabilities, with a severity and a link to the WatchGuard security advisory. It does not install anything for you. See the security update management requirements for what the control asks.
Upgrade Fireware OS
A6.4AUTO-FAILA6.1Fireware Web UI > System > Upgrade OS: install the latest release for your model; or WatchGuard Cloud > Configure > Devices > Firmware Upgrades > device menu > Upgrade FirmwareTrack WatchGuard PSIRT advisories
A6.4.2watchguard.com/wgrd-psirt/advisories: check at least weekly; record each critical or high advisory and the date you upgraded
A7: how do you configure WatchGuard Firebox for user access control?
Apply 2 settings in WatchGuard Firebox: one account per administrator and configure account lockout. Together they provide evidence for A7.2, A7.5, A7.8 and A7.10.
Named admin accounts with roles, and lockout on repeated failed logins. See the user access control requirements for what the control asks.
Configure account lockout
A7.10Fireware Web UI > System > Users and Roles > Account Lockout tab > Enable Account Lockout: Failed Login Attempts 10 or fewer, and set Users Locked Out For
A8: how do you configure WatchGuard Firebox for malware protection?
Apply 1 setting in WatchGuard Firebox: enable Gateway AntiVirus and WebBlocker on proxy policies. Together they provide evidence for A8.3.
Gateway AntiVirus and WebBlocker support A8.3. Devices still need their own protection for A8.1. See the malware protection requirements for what the control asks.
Enable Gateway AntiVirus and WebBlocker on proxy policies
A8.3Subscription Services > Gateway AntiVirus and WebBlocker > apply to the HTTP and HTTPS proxy policies
Which questions does this guide cover?
The 21 questions below are the ones WatchGuard Firebox can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.
| Question | What it asks | Steps in this guide |
|---|---|---|
| A4.10 | If you answered yes in question A4.9, is there a documented business requirement for this access? | A4: Keep management off the External interface |
| A4.11 | If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings? | A4: Keep management off the External interface; A4: Enable MFA for administrators |
| A4.2 | When you first receive an internet router or hardware firewall device, it may have had a default password on it. | A4: Change the default passphrases |
| A4.2.1 | Please describe the process for changing your firewall password. | A4: Change the default passphrases |
| A4.3 | How is your firewall password configured? | A4: Change the default passphrases |
| A4.5 | Do you have a process to manage your firewall? | A4: Review policies at least annually |
| A4.6 | Have you reviewed your firewall rules in the last 12 months? | A4: Review policies at least annually |
| A4.7 | Is your firewall configured to allow unauthenticated inbound connections? | A4: Document inbound policies |
| A4.8 | Please describe how you approve and document your allowed inbound connections. | A4: Document inbound policies |
| A4.9 | Are your boundary firewalls configured to allow access to their configuration settings over the internet? | A4: Keep management off the External interface |
| A5.1 | Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services? | A5: Remove unused service policies |
| A5.2 | Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business? | A5: Remove unused users |
| A6.1 | Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? | A6: Upgrade Fireware OS |
| A6.4AUTO-FAIL | Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release? | A6: Upgrade Fireware OS |
| A6.4.2 | Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release? | A6: Track WatchGuard PSIRT advisories |
| A7.10 | Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks? | A7: Configure account lockout |
| A7.2 | Are all your user and administrative accounts accessed by entering unique credentials? | A7: One account per administrator |
| A7.3 | How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation? | A5: Remove unused users |
| A7.5 | Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process? | A7: One account per administrator |
| A7.8 | Do you formally track which users have administrator accounts in your organisation? | A7: One account per administrator |
| A8.3 | If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites? | A8: Enable Gateway AntiVirus and WebBlocker on proxy policies |
What evidence should you keep for the assessor?
Keep the 4 dated records listed below for WatchGuard Firebox. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.
The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.
- Firewall policy export with descriptions.
- Screenshot of the WatchGuard Web UI and WatchGuard policy From lists.
- Device Management user list and the account lockout settings.
- Fireware version and upgrade history.
Related guides and requirements
- Firewalls requirementsThe control hub behind the first section of this guide.
- A7.16 and A7.17: MFA on cloud servicesThe automatic-fail questions most setup gaps lead to.
- Check your readinessFree checker that asks the auto-fail questions first.
- CE Plus test case 1: external vulnerability scanWhat the scan of your internet-facing IPs looks for.
- A4.9: admin interface on the internetWhen remote management needs MFA or an IP allow list.
- Glossary: boundary firewallThe NCSC definition.
- Fortinet FortiGateFirewall
- Sophos Firewall (XGS)Firewall
- Cisco Meraki MXFirewall
- Supported software listEnd-of-support dates for operating systems and applications.
- Cyber Essentials Plus: how to prepareWhat the tester checks on the day.
Frequently asked questions
Not on a physical Firebox. The default WatchGuard Web UI policy allows management from Any-Trusted and Any-Optional only. FireboxV and Firebox Cloud allow Any-External by default for initial setup, and WatchGuard says to remove it afterwards. If Any-External or a broad alias is in the policy, A4.9 becomes a yes and you need a documented business need plus MFA or a trusted IP allow list for A4.11.
No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.
The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- watchguard.comWatchGuard Help Center: Configure Firebox account lockout settingsRead on watchguard.com (opens in a new tab)
- watchguard.comWatchGuard Help Center: Manage users and roles on your locally-managed FireboxRead on watchguard.com (opens in a new tab)
- watchguard.comWatchGuard Help Center: Connect to Fireware Web UI from an external networkRead on watchguard.com (opens in a new tab)
- watchguard.comWatchGuard PSIRT: Security advisoriesRead on watchguard.com (opens in a new tab)