In short: The Cyber Essentials firewall requirements say every in-scope device must sit behind a correctly configured firewall, either a boundary firewall or a software firewall on the device. Default admin passwords must be changed, admin interfaces kept off the internet unless protected, unauthenticated inbound traffic blocked, and inbound rules approved, documented and removed when no longer needed.
What the firewall control covers
Every device runs network services so that it can talk to other systems. Each exposed service is a potential way in, so Cyber Essentials asks you to restrict what can be reached from the internet. The control applies to boundary firewalls, routers, desktops, laptops and servers, and to infrastructure, platform and software services in the cloud, where the equivalent is a data flow policy such as a security group.
There are two ways to provide the protection:
- A boundary firewall sits between your network and the internet and filters traffic for every device behind it, using rules based on source, destination and protocol
- A software firewall runs on the device itself and protects only that device, wherever it is. It is required when you do not control the network the device connects to
Most desktop and laptop operating systems include a firewall, and the NCSC advises switching the built-in one on in preference to adding a third-party product.
The firewall requirements in full
For every firewall, or network device with firewall functions, in scope you must:
- Replace the default administrative password with a strong, unique one (see our password requirements), or turn off remote administration altogether
- Keep the administrative interface unreachable from the internet, unless there is a clear, documented business need and the interface is protected by MFA, or by an IP allow list of a small range of trusted addresses combined with properly managed passwords
- Block unauthenticated inbound connections by default
- Have inbound rules approved and documented by an authorised person, recording the business need for each
- Remove or disable rules that are no longer needed
- Use a software firewall on any device used on untrusted networks, such as public Wi-Fi
Note the word and in the second point: a business reason on its own is not enough. If the admin page is on the internet, it needs MFA or an allow list as well.
Office, home, VPN and cloud: who provides the firewall?
Where the protection must come from depends on where the device connects.
| Situation | What must protect the device | Points to watch |
|---|---|---|
| Office network | Your boundary firewall or router | Change the default admin password and review inbound rules |
| Home worker on their own ISP router | A software firewall on the device | Home routers you did not supply are out of scope |
| Home worker on a router you supplied | That router, which is in scope | Apply the full firewall controls to it |
| Remote worker on a corporate VPN | The company firewall or cloud firewall at the other end | You must administer the VPN so the firewall rules apply |
| Public Wi-Fi, hotels, client sites | A software firewall on the device | Make sure it is on for public or untrusted network profiles |
| Infrastructure as a Service | Your rules plus the provider's | Security groups and network rules count as firewall rules |
| Software as a Service | Usually the cloud provider | Check the provider has committed to it in contract or contract-referenced documents |
More on this in Cyber Essentials, BYOD and home working and cloud services and Cyber Essentials.
Admin interfaces and remote management
Exposed firewall and router management pages are a favourite target for automated attacks, which is why the rules here are strict. In practice:
- Turn off web and SSH management on the internet-facing interface unless you have a written reason to keep it
- Where an outsourced IT provider manages the device remotely, restrict access to their fixed addresses and use managed, unique credentials, or put MFA in front of it
- If the firewall is managed through the vendor's cloud portal, treat that portal as a cloud service: logins to it must use MFA
- Record who holds admin credentials, and change them when people or suppliers leave
Default credentials on ISP-supplied routers deserve special attention. If the router is your office boundary device, it is in scope, and its default password must be changed.
Inbound rules: approve, document, prune
Most small networks need few or no inbound rules at all. Every port forward or allowed inbound service should have a named owner, a business reason and a sign-off. A simple rule register (rule, purpose, approver, date, review date) is enough evidence for most assessments.
Review it at least whenever your services change. Old rules for a retired VPN, a former supplier's remote access or a test server are exactly what an assessor, and an attacker, will find. It is also good practice to switch off Universal Plug and Play on routers where nothing needs it, because it lets devices on your network open inbound ports without anyone approving them.
How Cyber Essentials Plus checks your firewalls
At Cyber Essentials Plus, test case 1 is a remote vulnerability assessment. The assessor identifies every IP address you currently use, including those in your infrastructure-as-a-service platforms, scans them with an approved tool and reviews each internet-accessible service found, so an internet-reachable admin page or an unnecessary open port shows up quickly. Our guide to Cyber Essentials Plus vulnerability scans explains how to prepare.
Running your own external scan before you submit the self-assessment is the easiest way to check that your answers match reality.
How we help
We review firewall and router configurations against v3.3, close unnecessary ports, move remote management behind MFA or allow lists, check software firewalls on laptops through device management, and leave you with a documented rule register. Where your current kit cannot meet the controls or is out of support, we can recommend business-grade options such as Cisco Secure Firewall, Sophos Firewall, a cloud firewall or a Cisco Meraki security appliance; ask us for a quote.
Contact us to book a firewall review, or return to the Cyber Essentials requirements overview.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do I need a hardware firewall for Cyber Essentials?
Not necessarily. Each in-scope device must be protected by a correctly configured firewall, which can be a boundary firewall or router, or a software firewall on the device. Where you do not control the network, such as at home or on public Wi-Fi, the software firewall is what counts.
Is my home router in scope for Cyber Essentials?
Only if your organisation supplied it. Other home routers are out of scope, so the laptop or desktop used at home must run a software firewall instead. If the worker connects through a corporate VPN, the boundary is your company or cloud firewall.
Is the built-in Windows or macOS firewall good enough?
Yes, provided it is switched on and configured correctly. The NCSC advises using the firewall that comes with the operating system in preference to a third-party firewall application.
Can our IT provider manage our firewall remotely?
Yes, but the admin interface must not be open to the internet unless there is a documented business need and it is protected by MFA, or by an IP allow list of trusted addresses plus properly managed passwords.
Do cloud services need firewalls for Cyber Essentials?
The control applies to cloud services too. For infrastructure as a service you configure security groups or network rules yourself; for software as a service the provider usually implements it, and must have committed to doing so in your contract or its referenced documents.