Home and hybrid workers and Cyber Essentials

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

Are home workers' broadband routers in scope?

Business owners often worry that Cyber Essentials will require them to inspect the Sky, Virgin or BT router in every employee’s hallway. Thankfully, Section D(ii) of the NCSC Requirements for IT Infrastructure v3.3 (page 9) makes the rule very clear:

• Domestic ISP routers are OUT of scope: If a home worker connects through their own domestic broadband router (or a café or hotel Wi-Fi network), that router and its wireless access point are out of scope.
• Company-supplied routers are IN scope: Only if your organisation specifically supplies a dedicated router or hardware firewall to the home worker does that router come into scope.

The laptop's software firewall becomes your boundary

Because you do not control the home worker’s domestic router, you cannot rely on it as your boundary firewall. Instead, v3.3 gives you two ways to meet Control 1 (Firewalls) for home and hybrid workers:

1. Turn on the software firewall on the user’s device (standard approach): Ensure Windows Defender Firewall or the macOS built-in firewall is enabled on every laptop and blocks unauthenticated inbound connections across all network profiles (Domain, Private and Public).
2. Use a corporate Virtual Private Network (VPN): If the device connects through a corporate VPN administered by your organisation that routes traffic back to your office firewall or a managed cloud firewall, that company firewall forms the internet boundary. (Note: even with a VPN, keeping the laptop’s local software firewall switched on is best practice.)

Updates, device locking and BYOD at home

The biggest practical challenge with home workers is not their Wi-Fi — it is making sure their laptops still receive 14-day security updates, anti-malware definitions and password policies without needing to plug into the office network:

• Cloud-managed updates: Laptops that never touch an old on-premises Windows Server Update Services (WSUS) server need cloud policies (such as Microsoft Intune Windows Update rings) so updates download straight from Microsoft over home broadband and enforce a restart inside 14 days.
• Screen locking at home: Even at home, laptops and phones must lock automatically and require a 6+ character PIN, password or biometric.
• Personal home PCs: If a staff member logs into Microsoft 365 from a personal desktop in their study, that home PC comes into scope under the Personal devices (BYOD) rules. Most firms forbid using unmanaged home PCs for work files and supply a company laptop instead.