Step 2 of 7
Firewalls
A firewall controls what can reach your devices from the internet. Cyber Essentials looks at two layers: the router or firewall in your office, and the firewall built into each laptop and desktop.
How to do it
Check your office router
Make sure its firewall is switched on. Business-grade kit such as Ubiquiti UniFi, or a business router from your broadband provider, will usually do the job once it's set up properly.
Change the default admin password
Sign into the router's admin page and replace the default password with a unique one of at least 12 characters. Keep it in a password manager, not on a sticker.
Turn off remote admin
The router's admin page shouldn't be reachable from the internet. If you need to manage it remotely, use the manufacturer's cloud app protected with multi-factor authentication (MFA).
Review inbound rules
Look for port forwarding and other rules that let traffic in. Remove anything nobody can explain, write down why each remaining rule is needed, and turn off UPnP, which lets devices open ports on their own.
Switch on every laptop's firewall
On Windows, go to Windows Security, then Firewall and network protection, and make sure it's on for every network type. On a Mac, go to System Settings, then Network, then Firewall. The Mac firewall is off by default. If you use Intune, enforce this with a policy so it can't be switched off.
Common reasons people get caught out
- An ISP router still using the password printed on its sticker
- An old port forward for CCTV or remote desktop nobody remembers setting up
- Mac firewalls left off
Your checklist for this step
- A router or firewall protects every device on the office network
- Default admin passwords changed on routers and firewalls
- Router admin pages not reachable from the internet
- Inbound rules approved and documented, with unused ones removed
- Software firewall switched on for every laptop and desktop
This guide summarises Cyber Essentials Requirements v3.3 for small businesses. It is general guidance, not the official question set. Check the current requirements on the IASME website before you submit. Last updated 2 November 2026.