Firewalls for Cyber Essentials: your router, its admin password, and eleven questions

What “firewall” means here

Two layers, both usually already in the building. The boundary firewall sits between your network and the internet and blocks unexpected incoming connections — in a small office, that is the broadband router (A4.1). The software firewall is built into every copy of Windows and macOS and protects each device individually (A4.1.1) — which matters most for laptops that leave the office and sit on café and home Wi-Fi. Windows switches its firewall on by default; on a Mac it is off until you turn it on (System Settings → Network → Firewall), so check every Mac.

The admin password — the question that actually catches people (A4.2, A4.3)

Every router has two passwords, and the questionnaire cares about the one people never change: the admin password used to alter its settings, not the Wi-Fi password. It must be changed from whatever it came with — a unique-looking code on a sticker is still a default — and the new one must meet the password rule: at least 12 characters (three random words works), or 8 with common passwords blocked, or MFA if the device supports it. Changing it takes five minutes: browse to the router’s admin address (usually printed on it), log in with the current details, find “Administration” or “System”, set the new password, and keep it in a password manager or a locked drawer.

If it might be compromised (A4.4)

You are asked whether you would know how to change that password quickly if it were exposed — say the maker announced a security flaw. Having just changed it, you do: the honest answer is to name who does it and where. Write it into your firewall statement so the answer survives staff changes.

Inbound connections: blocked unless you meant it (A4.5–A4.8)

Routers block unsolicited inbound connections by default, and for most small businesses that is the end of the story — nothing on your network should be reachable from the internet without logging in (A4.7). If you have deliberately opened something — a VPN so people can work remotely, a server a customer connects to — each opening needs a written business reason signed off at board level — a director, in a small business (A4.5, A4.8) — and removal when no longer needed. And once a year, someone looks over the rules and clears out anything stale (A4.6). If you have never opened anything, the truthful answers are “inbound blocked by default, no custom rules, reviewed [date]” — short is fine.

One honest caveat: if something on your network is reachable from outside and you are not sure why or how safely, that is genuinely a case for a knowledgeable human — it is the one part of this control where guessing is dangerous.

Managing the router over the internet (A4.9)

Can the router’s settings be changed from outside — for instance so IT support can log in remotely? If yes, write down the business reason (A4.10) and protect it with MFA, or with an IP allow-list plus a strong admin password (A4.11) — otherwise switch it off. If the admin pages are only reachable from inside the office or over a VPN, the answer is simply no. Remember the support company’s login is your account in scope: it needs to meet the password rule, with MFA where the router supports it.

Home workers

A router your business supplied to someone’s home is in scope exactly like the office one — same password change, same questions. A home worker’s own broadband router is not in scope; instead the software firewall on their work laptop is relied on, which is why A4.1.1 matters. The scope guide covers who owns what.

What to have ready for the questionnaire

• Make, model and quantity of every router and firewall you own (asked at A2.5).
• Confirmation the admin password is changed and meets the password rule.
• A sentence on inbound: blocked by default, plus the reason for any rule you opened.
• The date someone last reviewed the rules.
• Whether remote management is off, or how it is protected.

Those five lines are your firewall statement — one of the short documents worth writing down once so every renewal starts ahead. The checklist has the section as tick-boxes.