Meeting Cyber Essentials Firewall Requirements With a Firewall That's Actually Managed

Cyber Essentials firewall requirements, properly implemented

Firewalls and internet gateways are one of the five technical control areas Cyber Essentials assesses, and it's an area where a lot of businesses assume "we have a firewall" is enough without checking whether it's actually configured to meet what the certification requires. Cyber essentials firewall requirements cover more than simply owning a firewall appliance — default administrative passwords must be changed, unnecessary services and open ports closed, rules documented and justified, and increasingly, device-level firewalls covered too, since remote and hybrid working means the network boundary Cyber Essentials originally assumed no longer matches how most businesses actually operate.

Our managed firewall services configure and monitor firewalls specifically against these requirements, whether that's a traditional office network boundary, a cloud-hosted environment, or individual laptops working from home that still need a properly configured host-based firewall to meet the standard. Firewall management, EDR endpoint protection and 24/7 monitoring are included as standard on our managed IT plans, from £20 per user per month, so the boundary control Cyber Essentials asks about is genuinely maintained, not configured once ahead of an assessment and quietly drifting out of compliance afterwards.

It's worth being specific about why the requirement has broadened beyond a single office router. Cyber Essentials was written at a time when most businesses had one network boundary and everyone worked inside it. Hybrid and remote working changed that reality faster than a lot of businesses updated their thinking about firewalls — a laptop connecting from a home network, a coffee shop, or a client site is effectively creating its own miniature network boundary every time, and if the device itself doesn't have a properly configured host-based firewall, there's no boundary control at all for that connection. That's precisely the gap Cyber Essentials assessments now specifically look for. We treat that shift as the new baseline rather than an edge case, which is why every managed IT plan we run includes host-based firewall configuration on every device by default, whether it spends its working life plugged into the office network or moving between a kitchen table, a train and a client's meeting room.

Managed Firewalls vs. an Appliance on Default Settings

Owning a firewall appliance and meeting cyber essentials firewall requirements are not the same thing. A firewall left on default administrative credentials, with unnecessary services still open and rules nobody can explain, will fail a Cyber Essentials assessment just as readily as having no firewall at all — arguably it's worse, because it creates a false sense of security. Managed firewall services close that gap by configuring, monitoring and periodically reviewing the firewall against what the standard actually requires, bundled into managed IT support from £20 per user per month rather than treated as a one-off installation job. It's a bit like buying a smoke alarm and never changing the battery — the device being physically present isn't what protects you, and an assessor asking about your firewall is really asking whether it's being actively maintained, not just whether one exists somewhere on the network diagram.