Cyber Essentials Firewall Requirements & Boundary Gateways
Detailed technical criteria and step-by-step checklist to satisfy the Cyber Essentials firewall requirements under NCSC standards v3.3.
Download 2026 Boundary Firewall & Gateway Pre-Audit Checklist PDF
Step-by-step audit verification checklist covering default-deny inbound rules, UPnP disabling, remote management WAN lockdown, and AWS/Azure cloud security group scoping.
What is a Boundary Firewall?
A boundary firewall is your network's first line of defence. It acts as a digital security guard, sitting between your private local area network (LAN) and the public internet. It monitors all incoming and outgoing data packets and decides whether to allow them through based on a set of strict rules.
For remote and hybrid workers, the "boundary" shifts to their home routers. Cyber Essentials requires these gateway routers to be secured, or protected via local host-based firewalls enabled directly on the operating systems of all business devices.
Why Scanners & Auditors Care
Vulnerability scanners automatically target public-facing IP addresses searching for open ports (like Remote Desktop RDP 3389 or SMB 445). If an assessor discovers an unauthenticated open admin portal or unprotected port during an external scan, the audit fails immediately.
Watch: Implementing Cyber Essentials Boundary Firewalls
Learn how to properly configure boundary gateways, change default ISP credentials, disable vulnerable UPnP protocols, and audit remote worker home routers under official NCSC standards.
Boundary Firewall Architecture & Packet Inspection Blueprint
Visual representation of the perimeter security zones enforced under Cyber Essentials technical requirements.
Cloud Boundary Firewalls (AWS & Azure) & Remote Worker Router Scoping
☁️ Cloud Firewalls (AWS Security Groups / Azure NSGs)
Cloud infrastructure hosting company data (AWS VPCs, Azure VNets, Google Cloud Compute) fall directly inside your audit scope. Security Groups must restrict inbound access, disabling default 0.0.0.0/0 ingress for management ports (RDP 3389, SSH 22).
🏠 Remote & Hybrid Worker Router Rules
Home routers used by employees working remotely do not require external physical reconfiguration. Instead, compliance is achieved by enforcing host-based firewalls on all corporate laptops and ensuring ISP router admin passwords are changed.
How to Achieve and Verify the Firewall Control
Follow this 4-step checklist to ensure your firewall configuration satisfies the official NCSC standard:
Change Default Administrative Credentials
Never leave your router or firewall with its factory-default login details (like "admin" / "admin" or "password"). Change these to a strong, unique password of at least 12 characters. This prevents simple brute-force takeovers from external scanners.
Disable Remote Administration and UPnP
Ensure that the router's admin interface is not accessible from the public internet. Disable "Remote Management" settings. Additionally, turn off Universal Plug and Play (UPnP). While UPnP is convenient for home gaming, it allows software inside your network to open ports automatically without administrator approval, creating stealth entry points.
Enforce a "Deny All Inbound" Policy
Your firewall rule set should block all incoming connection requests by default. Only create exception rules (port forwarding) for services that are essential and actively managed (e.g., VPN gateways). Document every open port and review them quarterly to ensure they are still necessary.
Enable Host-Based Firewalls on Endpoints
For mobile devices, laptops, and home-office workers who connect outside your corporate perimeter, enable the built-in host-based firewalls (like Windows Defender Firewall or macOS Application Firewall). This ensures that even when a device is connected to a public Wi-Fi network, it remains shielded.
How Boundary Firewalls and Password Policies Maintain Cyber Security
Under NCSC Cyber Essentials guidance, a boundary firewall and password policy function as dual complementary pillars to maintain cyber security across your business:
1. Perimeter Isolation (Boundary Firewall)
The boundary firewall blocks unauthorized inbound network traffic, hides internal IP subnets, disables UPnP, and restricts administrative port access from external internet threats.
2. Authentication Hardening (Password Policy)
A robust password policy ensures default router passwords are replaced with complex credentials, enforces multi-factor authentication (MFA) on admin accounts, and prevents credential stuffing attacks.
Frequently Asked Questions: Boundary Firewalls & Network Gateways
🌐 Does our standard BT, Virgin, or Vodafone ISP router satisfy Cyber Essentials? +
Yes, provided it is properly hardened. Standard ISP-supplied routers are acceptable as boundary firewalls only if: (1) factory-default admin passwords are changed to a complex credential (at least 12 characters), (2) remote internet web administration is disabled, and (3) Universal Plug and Play (UPnP) is switched off. If ISP firmware prevents changing these settings, software firewalls must be enforced on all endpoints via our Secure Configuration guidelines.
⚠️ Which open ports trigger an instant Cyber Essentials audit failure? +
Exposing administrative or insecure protocol ports directly to the public internet will cause immediate audit rejection. Common fail triggers include Port 3389 (RDP), Port 22 (SSH) without IP whitelisting or MFA, Port 445 (SMB), and Port 23 (Telnet). All remote access must be routed through an authenticated VPN or modern zero-trust gateway with mandatory Multi-Factor Authentication (MFA).
🏠 Do remote employees working from home need special hardware firewalls? +
No hardware changes are required. Under NCSC guidance for home workers, your organisation does not need to reconfigure or audit personal domestic routers. Instead, compliance is achieved by ensuring that host-based software firewalls (Windows Defender Firewall or macOS Application Firewall) are permanently enabled on all company-owned or BYOD business devices, combined with active Malware Protection & EDR.
☁️ How are AWS Security Groups and Azure Network Security Groups (NSGs) audited? +
Cloud infrastructure hosting organisational data or applications is treated as an in-scope network boundary. Security Groups and NSGs must enforce a strict "deny all inbound" policy. Ingress rules opening ports to 0.0.0.0/0 for non-public web services trigger non-compliance. See real-world cloud attack case studies on our UK Cyber Security News & Breach Insights page.
Boundary Firewall and Password Policy to Maintain Cyber Security
Under the UK National Cyber Security Centre (NCSC) Cyber Essentials requirements, boundary firewalls and administrative password policies function as co-dependent security controls. A boundary firewall is ineffective if an adversary can access its management portal using default manufacturer credentials, while a robust password policy cannot protect unsegmented networks if exposed administrative ports permit inbound brute-force attacks.
1. Mandatory Default Password Removal
Hardware routers, corporate firewalls, and ISP modem gateways ship with well-documented factory default passwords (e.g., admin/admin). Under Cyber Essentials Control #1 and #2, retaining default passwords causes immediate audit failure. All administrative passwords must be changed prior to deploying the device on a production network.
2. Account Lockout & Rate Limiting
To maintain cyber security, boundary firewall administration interfaces must enforce account lockout protections that limit unsuccessful login attempts to a maximum of 10 attempts within a 5-minute window, or throttle connection attempts with escalating rate-limiting delays.
3. Web Management Interface Isolation
The web administrative interface (HTTPS port 443/8443) of boundary firewalls must never be exposed directly to the public internet (WAN). Remote configuration must be strictly restricted to internal management subnets or accessible exclusively through an authenticated VPN with Multi-Factor Authentication (MFA).
4. Ingress Filtering & Port Blocking
All inbound traffic must be filtered using a default-deny policy. Dangerous legacy ports must be permanently blocked from public exposure, including RDP (3389), SMB (445), Telnet (23), and RPC (135). External vulnerability scans during Cyber Essentials Plus immediately flag open ingress ports.
| Compliance Requirement | NCSC v3.3 Standard | Audit Evidence Required | Pass / Fail Consequence |
|---|---|---|---|
| Router/Firewall Admin Password | Min 12 chars or 3 random words (no defaults) | Declaration & technical config snapshot | Instant Audit Fail if Default |
| WAN Interface Exposure | Disabled on public WAN; internal access only | External vulnerability port scan | Instant Audit Fail if Open |
| Remote Inbound RDP (3389) | Blocked or routed via MFA-authenticated VPN | Public IP range verification | Instant Audit Fail if Open |
| Remote Worker Home Routers | Host-based software firewalls enabled on all devices | MDM/Intune or endpoint configuration check | Fully Compliant |
Boundary Firewall and Password Policy to Maintain Cyber Security
Under the UK National Cyber Security Centre (NCSC) Cyber Essentials standard v3.3, boundary firewalls and password policies are intrinsically linked. A boundary firewall cannot defend your network perimeter if its administrative gateway relies on factory default credentials or weak authentication. To maintain robust cyber security and pass official IASME assessment, organisations must enforce strict boundary rules alongside comprehensive password governance.
🔑 Neutralizing Factory Default Passwords
Every boundary router, hardware firewall appliance (Cisco, Fortinet, SonicWall, DrayTek, Sophos), and ISP gateway must have its manufacturer default password replaced prior to deployment. Retaining default credentials is an automatic, instant audit failure.
🛡️ Management Interface WAN Isolation
Web administrative interfaces (HTTP/HTTPS ports 80, 443, 8080, 8443) and console ports (SSH port 22, Telnet port 23) must never be exposed to the public Internet (WAN). Management access must be restricted to an isolated internal administrative VLAN or an MFA-authenticated VPN.
📏 Password Length & Complexity Standards
All administrative and user accounts must satisfy NCSC password rules: minimum 12 characters, or adoption of the NCSC "Three Random Words" passphrase technique. Arbitrary 30-day password expiry that encourages predictable permutations is explicitly discouraged.
🚫 Brute-Force & Account Lockout Protection
Boundary gateways and remote access points must implement rate-limiting or automated account lockouts after a maximum of 10 consecutive failed authentication attempts, preventing automated credential-stuffing and dictionary attacks.
| Perimeter Security Control | NCSC v3.3 Password & Firewall Standard | What the Assessor Checks | Compliance Result |
|---|---|---|---|
| Router / Firewall Admin Password | Default vendor password changed; 12+ chars or 3 random words | Assessor questionnaire confirmation & scoping review | Mandatory to Pass |
| WAN Management Exposure | Disabled entirely on public internet interface | External vulnerability port scan across public IP block | Fail if Port 80/443 Open |
| Remote Gateway MFA | Multi-Factor Authentication on all inbound administrative VPNs | Authenticator app / FIDO token configuration evidence | Mandatory to Pass |
| Brute Force Rate Limiting | Lockout or throttle after max 10 failed login attempts | Account lockout policy threshold screenshot | Fully Compliant |
Secure Configuration Audit Self-Check
1. Neutralizing Factory Default Passwords
All manufacturer default passwords on routers, switches, firewalls, and server appliances must be replaced with strong, unique passwords (minimum 12 characters or 3 random words). Leaving default credentials active is an automatic Cyber Essentials failure.
2. Disabling Unnecessary Services & Auto-Run
All pre-installed bloatware, unneeded server roles (Telnet, SMBv1, TFTP), and legacy communication protocols must be disabled. Auto-run and auto-play on external USB media must be blocked via Group Policy or Intune.
3. Account Lockout & Brute-Force Defence
Devices must enforce an account lockout threshold preventing brute-force password guessing (maximum 10 invalid attempts, or rate-limiting with progressive delays).