Cyber Essentials firewall requirements for offices, routers and home workers

The NCSC requirements say each in-scope device must be protected by a correctly configured firewall, or by a network device that provides firewall functionality. That wording covers more than the box in the comms cupboard. An office router, a cloud or virtual firewall, and the built-in software firewall on a laptop all count, depending on where the device sits and how it connects to the internet.

For desktops and laptops, the NCSC advises switching on the firewall that ships with the operating system rather than installing a third-party product. In practice, the first check for a small business is simple: confirm the Windows or macOS firewall is enabled on every device used for business, and that staff cannot casually turn it off.

Any device used for business, whether company-owned or a personal device used for work, is in scope by default. That includes the laptop at a kitchen table and a personal phone with company email on it. Each of those devices needs firewall protection that you can show is enabled.

A worker's own home router is out of scope, because you do not own or manage it. The business therefore applies the control on the device itself, which means the software firewall. If you supplied the router, for example a 4G unit posted to a new starter, it is in scope and must meet the same configuration rules as an office router. The same device-level logic applies on public Wi-Fi, where the software firewall is the protection that travels with the laptop.

Any firewall or router you manage must not keep its factory administrative password. Change it to a strong, unique password, or disable remote administration altogether. A shared default such as the one printed on a label is the classic finding, and it is easy for an assessor to spot on a supplied router.

The administrative interface must not be reachable from the internet unless there is a clear, documented business need. Where that need exists, the interface must be protected by multi-factor authentication, or by an IP allow list combined with properly managed password authentication. If nobody can explain why the admin page is exposed, turn the remote access off.

The firewall must block unauthenticated inbound connections by default. Anything you allow in, such as a port forward to a file server or a camera system, needs an approved rule with the business reason written down and an owner who signed it off.

Rules go stale. A forward set up for a contractor two years ago, or for software you no longer run, is an open door nobody remembers. Review the rule list at least when you prepare for assessment, and remove or disable any rule whose business need has ended. A short spreadsheet with the rule, the reason, the approver and the date is usually enough evidence.

If staff reach the office over a corporate VPN, the NCSC treats the company firewall, or your virtual or cloud firewall, as the internet boundary. That does not remove the need to protect the individual devices with their own firewall, so both layers still apply.

Remote desktop is where small businesses get caught. The ICO's employer guidance says to allow remote access only for staff who need it and to consider a gateway or VPN for the longer term. Moving the listening port to a different number is described only as a temporary measure, not a secure design. Exposing remote desktop directly to the internet on port 3389, or any other port, is the arrangement to remove first.

List every device used for work, marking which are company-owned and which are personal. Confirm the software firewall is on for each one, and record how you checked, for example a screenshot, an endpoint management report or a short script output. Identify any router you supplied to staff and treat each one as in scope.

For routers and firewalls you manage, record the changed admin password, the state of remote administration, and the documented inbound rules with reasons. The ICO also recommends a clear remote-working policy, current remote-access software, unique passwords and MFA where available, which fit alongside these records. The NCSC publishes updated requirements versions from time to time, so check the current document on the NCSC site before your assessment rather than relying on an older copy.