Home workers and Cyber Essentials: the router rule, explained properly

Are home workers in scope?

Yes. Anyone who does work for the business is a user for Cyber Essentials purposes wherever they sit, and the device they work on — laptop, desktop, phone or tablet — is in scope if it connects to the internet and touches business data or services. Working from home changes where the device is, not whether it counts. What home working does change is the equipment around the device: the employee’s own broadband router is not in scope, and the scheme relies on the device’s own software firewall instead. The rest of this guide explains that trade and the two scope questions that record it.

What the questionnaire asks

The scope section wants two facts about remote work: how many people work from home or remotely (A2.4.1), and how they connect — over their own home router, a router the business supplied, or a VPN (A2.4.2). Those answers decide which firewall questions apply to what, so count honestly: “mostly office but Fridays at home” is a home worker for this purpose.

The router rule

A router your business supplied to someone’s home is in scope exactly like the office one: listed with make and model, admin password changed from the default, the same A4 questions. A home worker’s own broadband router is outside formal scope — the scheme doesn’t expect you to administer equipment you don’t own. In its place, the requirements lean on the software firewall built into the work device itself (A4.1.1): it must be switched on, on every laptop, precisely because those laptops sit on networks you don’t control.

That logic extends anywhere: café Wi-Fi, hotel networks, a client’s office. The device carries its own boundary with it — the software firewall (A4.1.1) — which is why that setting is checked for every machine, not just the travelling ones, alongside the screen lock (A5.9).

The home router itself: what is sensible, not what is required

Because the employee’s own router is out of scope, nothing about it is assessed and you should not list it. That said, a few minutes of good practice cost nothing and protect the laptop that is assessed: change the router’s admin password from the default, install the firmware updates the provider offers, keep the Wi-Fi on WPA2 or WPA3 with a proper passphrase, and switch off remote administration if it was ever turned on. None of that appears in your answers — it is simply what a reasonable business asks of people who work from home, and it makes the “software firewall on” answer sit on firmer ground.

VPNs: an option, not a requirement

Cyber Essentials does not require home workers to use a VPN. It appears in A2.4.2 as one of the ways people connect, and if you do use one, the equipment behind it may come into scope accordingly — a company VPN that lands traffic on the office network puts the office firewall in the path, which is precisely why the questionnaire asks. If you don’t use one, “they connect over their own broadband” plus device firewalls on is a complete answer to the remote-working part of the scope.

Everything else follows the device, not the address

A home worker’s laptop meets the same requirements as an office one: supported operating system, automatic updates within 14 days, screen lock, anti-malware, no admin account for daily use. Their cloud logins need MFA like everyone else’s. Their personal phone follows the BYOD rule if work email is on it. In other words: remote working changes one question about routers and nothing else — the controls were already per-device and per-account.

A worked example

Twelve staff, no office. Everyone works from home on their own broadband; no business-owned routers. Devices: twelve company laptops (software firewalls on, automatic updates on, screens lock), twelve personal phones with work email (in scope under BYOD). Cloud services: Google Workspace, Xero, Slack — MFA on for all users and admins. That covers remote working without a VPN, company routers or anyone visiting anyone’s house. The scope guide has more worked examples.

Where it goes wrong

• Undercounting. Hybrid workers count; the director working Sundays at home counts.
• Listing home routers you don’t own — or worse, promising to manage them. Neither is asked for.
• Forgetting the company router you did supply to one person years ago. If the business owns it, it is in scope with a model number and a changed admin password.
• Software firewalls switched off by an old “it was blocking something” decision. Turn them back on; the A4.1.1 answer must hold for every machine.