If no, please describe the way that your sites are connected.
What this question is really asking
If some sites connect through another site rather than directly to the internet, describe the architecture. Assessors need to understand how traffic flows between sites — leased lines, SD-WAN, and VPN links all need to be addressed in your firewall and scope responses.
What satisfies this requirement
A written response is requiredProvide details of connection methods between interconnected sites.
What to prepare before your assessor visit
Assessors want to understand whether internet traffic from your satellite sites traverses your main firewall or breaks out locally. Traffic routing through a hub site is generally straightforward; traffic breaking out locally at each site means each site needs its own compliant boundary firewall and must be addressed individually in your A4 responses.
How this question sits across CE versions
Question A2.3.2 is unique to Cyber Essentials Danzell — it does not appear in other versions of the standard. New in Danzell.
Related policy templates
Getting certified means having documentation to back it up. These policy templates cover the controls this question tests.
Does your organisation meet this requirement?
Answer 30 plain-English questions and find out exactly where you stand across all 5 Cyber Essentials control areas — with a prioritised list of what to fix first.