Firewalls & internet gateways
A boundary between your devices and the internet, so only the services you actually need are reachable from outside.
🔍 What a scan can verify
Our exposure and in-depth scans can see which ports/services are open to the internet — an exposed database, remote-desktop or admin service is a visible boundary gap.
📝 What stays self-declared
We can't see your internal firewall configuration, whether default firewall passwords were changed, or whether each remote/home-working device has its own firewall — you tell us those.
What Cyber Essentials asks for this control
- Is every device that connects to the internet protected by a firewall — including laptops used by home or remote workers?
On laptops away from the office this means the device's own software firewall, since they're not behind the office firewall.
- Have the default administrative passwords on your firewalls/routers been changed to strong, unique ones?
Default device passwords are public knowledge — leaving them is treated as an automatic fail.
Mandatory item — a “No” here fails this whole control.
- Are inbound services from the internet blocked unless there is a documented business need for them?
Anything reachable from outside (databases, remote desktop, admin panels) should have a justified reason to be open.
How to get ready
- Turn on the built-in software firewall on every laptop and desktop, especially devices used away from the office.
- Change any default router/firewall admin passwords to strong, unique ones.
- Close inbound services you don't need; for anything that must stay open, write down why.
Check your firewalls & internet gateways — and the other four controls
Answer the Cyber Essentials questions in plain English and get a per-control readiness verdict — free, no login needed, and we don't store your answers.
Start the free readiness check →← Back to all five Cyber Essentials controls.
This is a free readiness / gap report to help you prepare — it is not a certification, and we are not an IASME Certification Body. To certify, you apply through an accredited Certification Body.