Montpellier A4.1.1

When your devices (including computers used by homeworkers) are being used away from your workplace, how do you ensure they are protected?

Section A4: Firewalls  ·  Cyber Essentials Montpellier

This requirement was absorbed into A4.1 in Danzell — it still applies but is assessed within the boundary firewall question.

What this question is really asking

Confirm that a software firewall is enabled on all laptops, desktops, and servers within scope. This is a host-based control that complements boundary firewalls. Windows Defender Firewall, macOS application firewall, and equivalent Linux tools are all acceptable. MDM or Group Policy enforcement is expected — relying on users to keep their host firewall enabled is not sufficient evidence.

What satisfies this requirement

A written response is required

Home workers not on corporate VPN must rely on the software firewall in the OS.

Check how you answer this in the CE Explorer
Free tool — all 288 questions mapped across every CE version.
Open CE Explorer

What to prepare before your assessor visit

'We have Windows Defender Firewall' is a reasonable start, but assessors want to know it is enforced rather than merely recommended. A screenshot of one PC is not sufficient — show the Group Policy object or MDM profile that enforces the software firewall across all managed devices. If users can disable the firewall themselves, it is not a reliable control and assessors will note the gap.

How this question sits across CE versions

Montpellier You are here
When your devices (including computers used by homeworkers) are being used away from your workplace, how do you ensure they are protected?
Willow View →
Do you have software firewalls enabled on all of your computers, laptops and servers?
Danzell View →
Do you have software firewalls enabled on all of your computers, laptops and servers?

Related policy templates

Getting certified means having documentation to back it up. These policy templates cover the controls this question tests.

Network Security Policy
Covers boundary and host-based firewall requirements, rule management, and network access…
Acceptable Use Policy
Sets out how devices must be configured, what software is permitted, and how users are ex…
← Previous
A4.1
Do you have firewalls at the boundaries between your organisation's i…
Next →
A4.2
When you first receive an internet router or hardware firewall device…

Does your organisation meet this requirement?

Answer 30 plain-English questions and find out exactly where you stand across all 5 Cyber Essentials control areas — with a prioritised list of what to fix first.

Check my readiness → Explore all questions first