What Is a Firewall Under Cyber Essentials?

What Is a Firewall Under Cyber Essentials?

Last updated: 3 October 2026

Under Cyber Essentials, a firewall is the control that sits between your devices and the internet. It decides which connections are allowed in and out, and blocks everything else.

It is the first of the five technical controls set out by the National Cyber Security Centre (NCSC), and it applies to every device that connects to an untrusted network, including laptops used at home or on public Wi-Fi.

What Cyber Essentials requires

• A boundary firewall (often the one built into your business router) protecting every device on your office network.
• A software firewall switched on for devices used on untrusted networks, such as laptops at home, in cafes or on hotel Wi-Fi.
• Default administrator passwords changed to a strong, unique password on every firewall and router.
• Unauthenticated inbound connections blocked by default, with each open port approved and documented by the business.
• The firewall admin interface not exposed to the internet unless it is protected, for example with multi-factor authentication or an IP allow-list.
• Rules you no longer need removed or disabled promptly.

Where businesses most often slip up

• Leaving the router on its factory password or default settings.
• Port forwarding rules set up years ago for a supplier or project and never removed.
• Remote staff laptops with the built-in firewall switched off.
• No record of why each firewall rule exists or who approved it.

How ABCOM helps

ABCOM checks your firewall and router settings against the Cyber Essentials requirements, tidies up old rules, secures remote access, and documents the rules so you can answer the assessment questions with confidence. For managed clients we monitor and maintain the firewall as part of our service.

This is one of the five Cyber Essentials technical controls. Not sure whether your business would pass? Take our free 4-minute readiness quiz, or book a free cyber security review.