Routers, firewalls and other network devices

Routers and firewalls that sit between your network and the internet are in scope for Cyber Essentials, whether they are a dedicated firewall appliance or the router your broadband provider supplied to the office. They must meet the firewall control and the security update control. Home routers are out of scope unless your organisation supplied them.

Which network devices are in scope

• Your office or site router and any boundary firewall. If it controls traffic between your devices and the internet, it is in scope.
• Virtual and cloud firewalls you administer, including those used by a corporate VPN.
• Routers you give to home workers. These are in scope. Other home routers are not. See home and remote workers.
• Wireless devices, including access points, are in scope if they can communicate with other devices over the internet. They are out of scope if an attacker could only reach them from within wireless range, or if they are part of an ISP router at a home or remote location.

IASME's scope FAQ says printers and network switches are out of scope. Firmware and the software that manages your network is still software, so anything in scope must be supported and patched.

Firewall requirements for routers

For every firewall, or network device with firewall functions, Requirements v3.3 says you must:

1. Change the default admin password to a strong, unique one, or switch off remote administration altogether.
2. Keep the admin interface off the internet. It may only be reachable from the internet if there is a documented business need and it is protected by MFA, or by an allow list of a small range of trusted IP addresses plus a properly managed password.
3. Block unauthenticated inbound connections by default.
4. Approve and document inbound rules. Each rule, such as a port forward, needs an authorised person's approval and a recorded business reason.
5. Remove rules you no longer need.

Most current business and ISP routers block unsolicited inbound traffic out of the box, but check rather than assume. Old port forwards for a camera system or a former remote access tool are a common finding.

Updates and support

Router and firewall firmware counts as software under v3.3. That means:

• the device must still be supported by its vendor with security fixes. A router that no longer gets firmware updates must be replaced, or removed from scope,
• firmware updates that fix critical or high-risk vulnerabilities, or a CVSS v3 score of 7 or more, or that give no severity, must be installed within 14 days of release,
• automatic updates should be on where the device offers them.

ISP-supplied routers are often updated by the provider remotely. If you rely on that, find the provider's statement about it. Under Danzell, the question about installing critical and high updates for operating systems and router or firewall firmware within 14 days is treated as an automatic fail. See the 14-day update rule.

No boundary firewall?

Many small organisations have no office network at all. That is fine. Every laptop and desktop then relies on its own software firewall, which must be on and configured. See firewalls.

What to do

1. List each router, firewall and access point you control, with make, model and firmware version.
2. Check each is still supported by the vendor, using the vendor's end-of-life notices.
3. Log in to each, change any default admin password, and turn off remote administration unless you need it.
4. Review the inbound rules and port forwards. Remove what is not needed, and write down who approved the rest and why.
5. Turn on automatic firmware updates, or set a monthly reminder to check.