Firewalls are the first of the five Cyber Essentials controls. The scheme requires every internet-facing perimeter device and every in-scope endpoint to have a firewall configured to deny inbound connections by default and restrict outbound connections to what the firm actually needs.
Every device in scope (workstations, laptops, servers, mobile devices used to access company data) must have a firewall enabled.
Every internet-facing boundary firewall must change the default administrative password and disable any unauthenticated remote management.
Inbound traffic from the internet must be blocked by default; only ports and services with a documented business need may be open.
Outbound traffic should be restricted where the business need is known (e.g. block direct outbound from servers that should only egress through a proxy).
Personal firewalls on home-working devices must be configured under the same rules as office devices in scope.
Confirms the perimeter firewall is on a current vendor-supported firmware release with patches applied inside the 14-day window for high-severity CVEs.
Verifies the default administrative password has been changed; confirms unauthenticated remote management is disabled.
Samples in-scope devices to verify the OS firewall (Windows Defender Firewall, macOS Firewall, or third-party equivalent) is enabled and configured to deny inbound by default.
Reviews any documented inbound port openings against the stated business need.
Across CE Plus engagements, the following gaps recur on this control. None require deep architectural change. Most are operational discipline that drifted between annual assessments.
Default admin credentials still on the perimeter firewall (most often a small SOHO router replaced with a business-grade unit but never reconfigured).
OS firewall disabled on developer or engineer laptops because it interfered with a development tool, then never re-enabled.
Firmware on the perimeter firewall lagging the vendor release by months because the MSP does not own firmware updates.
Home-worker devices in scope but with no documented configuration baseline.
Devices and software are configured to remove or disable unused services, change default passwords, and apply secure baseline settings.
Access to data and services is controlled through individual accounts with appropriate privileges, and administrative privileges are tightly restricted.
Every in-scope device runs malware protection (anti-virus or equivalent) configured to scan in real-time and update its signatures regularly.
All software is kept up-to-date and patches for high-severity and critical vulnerabilities are applied within 14 days of vendor release.