Section 4: Firewalls
You need a firewall between your school network and the internet. This can be a:
- firewall or router on site
- firewall that your broadband provider or IT company manages for you
- cloud or virtual firewall
If someone else manages it, you are still responsible for confirming it meets the requirements.
NCSC says every device in scope must be protected by a correctly configured firewall or a network device with firewall functionality (Requirements v3.3, page 13). For cloud services, the firewall provider depends on the service type (Table 1, page 10):
- SaaS – the provider
- PaaS - mostly the provider for PaaS
- IaaS – shared
4.1.1 Do you have software firewalls enabled on all computers, laptops and servers?
Switch on the built-in firewall on every computer, laptop and server, even if it sits behind your school firewall. Windows, macOS and common Linux versions all have a firewall built in, so you rarely need to buy anything.
This matters most for staff laptops used outside school. NCSC says a software firewall must be used on devices that connect to networks you do not control (Requirements v3.3, pages 13 to 14).
4.1.2 If No to A4.1.1 - is it because software firewalls are not available for the OS in use? Please list the OS.
If you answered No to 4.1.1 because the firewall is switched off, switch it on and answer Yes to 4.1.1 instead.
Almost every operating system has a software firewall, including all versions of Windows, macOS and common Linux versions such as Ubuntu. Only a few embedded or specialist systems do not.
For any decide that does not have a software firewall, list the operating system and version.
If every device has a software firewall enabled, say so.
This is the password used to log in to the firewall or router settings, not the WiFi password. NCSC recommends changing the default administrator passwords to a strong, unique password or disabling remote administration entirely (Requirements v3.3, page 14).
Change the default on every firewall and router, including ones that arrive with a unique password already printed on them. If your broadband provider or IT company manages the device, ask them to confirm in writing that this has been done.
Home routers that the school did not supply are not included.
4.2.1 Please describe the process for changing your firewall password.
Include:
- who changes the password
- when it is changed (for example when a new router or firewall is installed or replaced)
- how the password is changed
If an outside company manages your IT or your firewall, include how you confirm with them that this is done. IASME says the easiest evidence is a contract with the provider that includes the Cyber Essentials controls.
Home routers that the school did not supply are not included.
Choose the option that matches how the admin login to your firewall and router is protected. This may cover both your firewall and your router:
- the login needs a second step as well as a password (MFA).
- the system blocks common passwords such as 'password' and needs at least 8 characters.
- a single password of at least 12 characters, with no maximum length.
- no password is used, for example a security key, passkey or biometric.
- none of these apply - describe what you use
If your provider manages the firewall, ask them which option applies and choose that one.
NCSC explains the password rules on pages 20 to 22 of Requirements v3.3.
Passwords may be compromised because of a virus on your system or if the manufacturer tells you about a security weakness. You must know how to promptly change the password.
If your IT provider holds the firewall password, make sure you can still get access to your own firewall and know how to have the password changed. IASME warns that you cannot give all the responsibility for this to your IT provider.
NCSC requires an established process to promptly change passwords if you know or suspect a compromise (Requirements v3.3, page 22).
A process means you know:
- who can change the firewall
- how a change is requested and approved
- how a change is recorded
If a provider runs your firewall, your process is:
- how you ask them for changes (for example, through a support ticket)
- who at school approves the request
Opening a port to makes something inside your network reachable from the internet needs a business case (see 4.8).
NCSC requires you to remove or disable unneeded firewall rules (Requirements v3.3, page 14). If a provider manages the firewall, say how they report their review to you.
Describe:
- when your firewall rules were last reviewed
- who reviewed them
- how often reviews happen
You must remove any services you no longer need to be open on the firewall, so your process should say:
- when services are reviewed
- who decides to remove services
- who checks it has been done
Most firewalls block all inbound connections by default, but you must check. NCSC says unauthenticated inbound connections must be blocked by default (Requirements v3.3, page 14). If you have opened a port for a genuine business need, it must be documented (see 4.8). If a provider manages your firewall, ask them to confirm the default setting.
Answer Yes if someone on the internet could reach a service inside your school without logging in.
"Opening a port" means that something inside your school can be reached from the internet, for example a VPN, mail server, or system a supplier connects to. Each one needs a recorded business reason, approved by a senior leader, with the risks reviewed regularly. IASME asks for this to be signed off at board level.
Include in your answer who approves, where approval is recorded, and how often it is reviewed. NCSC requires inbound firewall rules to be approved and documented by an authorised person, including the business need (Requirements v3.3, page 14).
If you have no open ports, say so.
Answer Yes if the firewall's admin page can be reached from the internet, for example so your IT support company can log in remotely. If you answer Yes, you must also answer 4.10 and 4.11. Ask your provider if you are unsure.
Answer No if it can only be reached from inside the school network or through a VPN that you control.
VPN services bought off the shelf do not count, because you do not control the internet boundary.
If you answered Yes to 4.9, include in your answer:
- why someone needs to manage the firewall over the internet
- who agreed it and where it is recorded
If you answered No to 4.9, write 4.9 was No - firewall settings cannot be reached from the internet. Answering No here means remote access is switched on without a documented reason, which does not meet the requirements.
If you answered Yes to 4.9 and your firewall settings can be reached from the internet, you must protect them. Choose if you do this by:
- MFA (a second step when logging in)
- a list of trusted IP addresses, for example your IT provider's addresses only, combined with a properly managed password
If 4.9 was No, write 4.9 was No - firewall settings cannot be reached from the internet. NCSC sets this rule on page 14 of Requirements v3.3.
Did you find what you needed?
Fill in our 3 question survey and let us know if you need more help.