Firewalls: what Cyber Essentials needs

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

Boundary firewalls versus software firewalls

A firewall controls network traffic flowing into and out of your devices. Under Section E.1 of the NCSC Requirements for IT Infrastructure v3.3, every device in scope (desktops, laptops, servers, and cloud environments) must be protected by a correctly configured firewall:

• In your office: Your boundary router or dedicated firewall sits between your office network and the internet.
• Outside your office (home working, hotels, cafés): Because your business does not control a staff member’s home router or public Wi-Fi, you must turn on the built-in software firewall (Windows Defender Firewall or the macOS application firewall) on every laptop, or route traffic through a company-administered corporate Virtual Private Network (VPN) that terminates at your office or cloud firewall.

Notice a useful simplification in v3.3: earlier editions used the phrase “untrusted networks” in their scoping rules, which caused endless debate over whether a staff member’s home Wi-Fi was “trusted”. Version 3.3 removes “untrusted” from the scope criteria and states plainly that if your organisation does not supply and control the network router, the device’s own software firewall must be switched on.

Five mandatory rules for every router and firewall

For every boundary firewall, office router, or software firewall in scope, v3.3 requires five things:

1. Change the default administrative password: Replace the factory password with a strong, unique password meeting the scheme’s password rules (at least 12 characters, or 8+ characters with a deny list or MFA) — or disable remote administrative access altogether.
2. Lock down the administrative interface from the internet: Your router or firewall’s web configuration page (or SSH/management port) must not be accessible from the internet, unless there is a clear, documented business need and it is protected by either:
   • Multi-Factor Authentication (MFA), or
   • An IP allow-list restricting access to a small set of trusted IP addresses combined with managed password authentication.
3. Block unauthenticated inbound connections by default: Unless you have deliberately created an approved rule, unsolicited traffic from the internet must be dropped.
4. Approve and document any inbound firewall rules: If you open a port or port-forward traffic from the internet, an authorised person must approve it and record the business reason in writing.
5. Remove rules as soon as they are no longer needed: Old port forwards for retired servers, CCTV systems or temporary contractors must be deleted or disabled promptly.

Internet-provider (ISP) routers and home routers

Many small UK offices use the router supplied by BT, Virgin Media, Sky or Zen. That office router is the boundary firewall for your office network, so it is in scope. You must change its admin password, ensure its admin page cannot be reached from the internet, and confirm it still receives firmware updates.

For home workers, Section D(ii) of v3.3 draws a clear line: if your company supplies a router to the home worker, that router is in scope. If the worker uses their own domestic ISP router, that home router is out of scope — provided the work laptop has its software firewall switched on (or uses a corporate VPN). See our guide to home and hybrid workers.

Router firmware now falls under the 14-day auto-fail rule

Under the April 2026 Danzell marking rules, operating systems and router and firewall firmware sit in a single automatic-fail check. High-risk or critical firmware updates must be applied within 14 days of release, and an end-of-life office router that no longer receives security fixes will fail your assessment. See the 14-day patching rule.