Home and remote workers

Home and remote working devices are in scope for Cyber Essentials, whether they belong to the organisation or to the worker. The home broadband router is out of scope unless your organisation supplied it. Because you do not control that router, the firewall control moves onto the device itself: each laptop and desktop must have its software firewall turned on and configured.

The default position

Requirements v3.3 starts from the view that all corporate and BYOD devices used for the organisation's business at home or remotely are in scope. Working from a kitchen table, a hotel or a train makes no difference to the controls a device needs.

Home routers

• A router your organisation provides to the worker is in scope. It must meet the firewall and update requirements like an office router: default admin password changed, admin interface not exposed to the internet, supported firmware kept up to date.
• Any other router, such as the one from the worker's broadband provider, is out of scope. You do not list it and you do not need to configure it. Wireless access points built into an ISP router at a home location are also out of scope.

Since the home router is not part of your controls, you must apply the firewall controls on the device. For most organisations that means the built-in firewall: Windows Defender Firewall on Windows, the macOS firewall on Macs. Version 3.3 advises using the pre-installed software firewall rather than a third-party one. The software firewall must block unauthenticated inbound connections by default, and its admin settings must be protected by the device's administrator account. See firewalls.

VPNs

If remote workers connect through a corporate VPN, their internet boundary is your company firewall or a virtual or cloud firewall that you administer. Version 3.3 defines a corporate VPN as one that connects back to your office or to a firewall you manage, so that you can apply the firewall controls. A consumer VPN app does not move the boundary. IASME's VPN guidance covers the difference.

Even with a VPN, keep the device firewall on. Many VPNs only route some traffic, and the device may be used before the VPN connects.

Tethering and public wifi

When a laptop is tethered to a phone's 4G or 5G connection, or joins public wifi, there is no boundary firewall you control. The device's software firewall is the boundary. Version 3.3 specifically asks you to use a software firewall on devices used on untrusted networks such as public hotspots.

The other controls still apply

Remote devices need everything an office device needs:

• supported operating systems and applications, with critical and high updates installed within 14 days, and automatic updates on,
• a screen lock and lockout after repeated failed attempts,
• malware protection,
• unique accounts, separate admin accounts and MFA on cloud services.

Remote devices are often the ones that fall behind on updates because they are rarely on the office network. Use cloud-based device management, such as Intune or an MDM, so you can see and push updates wherever the device is.

What to do

1. List every device used for remote work, including personal ones.
2. Find out whether you supply any routers. If so, list and secure them.
3. Turn on the software firewall on every laptop and desktop, and enforce it centrally if you can.
4. If you use a VPN, record whether it is a corporate VPN you administer.
5. Check that remote devices report in for updates, and chase any that have not been seen recently.

The readiness checker asks how your staff work and adjusts the firewall questions to match.