Serviced Offices and Cyber Essentials
Meeting Firewall Requirements in a Shared or Serviced Office
If your business operates out of a serviced office or co-working space, you don't need to manage your own network to meet the Cyber Essentials firewall requirements. Instead, you can confirm with your provider that the right controls are already in place. Here's how.
What the Requirements Say
According to the official Cyber Essentials specification, every firewall (or equivalent network device) must be set up so that, on an ongoing basis:
Default passwords are changed. The administrative password should be changed to something difficult to guess, or remote administrative access should be turned off entirely.
The admin interface isn't exposed to the internet, unless there's a clear, documented business reason for it, and it's protected by either: (A) a second authentication factor, such as a one-time code, or (B) an IP whitelist that limits access to a small number of trusted addresses.
Unauthenticated inbound connections are blocked by default.
Inbound firewall rules are approved and documented, with the business reason for each rule recorded.
Rules are removed promptly once no longer needed. Devices used on untrusted networks, such as public Wi-Fi, should also have a host-based firewall enabled.
How to Confirm This With Your Provider
You can use the template below to check these controls are in place. Just fill in your provider's details and send it over:
To [service provider],
We're applying for Cyber Essentials certification and need to confirm the security controls in place on our network. Could you please confirm the following:
There is a firewall in place at the boundary between our network and the internet.
The default password on this device has been changed.
The new password is at least 8 characters long and difficult to guess.
If the password were believed to be compromised, it would be changed.
Only approved, whitelisted services are allowed to send data to the internet, and these are removed once no longer needed.