Montpellier
A4.5.1
Do you have a documented business case for all of these services?
What this question is really asking
Business case must be documented, recorded, signed off at board level, and risks reviewed regularly.
What satisfies this requirement
Yes or NoBusiness case must be documented, recorded, signed off at board level, and risks reviewed regularly.
Check how you answer this in the CE Explorer
Free tool — all 288 questions mapped across every CE version.
What to prepare before your assessor visit
Document your approach clearly and be ready to evidence it. Assessors look for consistent, repeatable processes — not just a correct answer on the day. Make sure whoever manages this control can explain it without referring to notes.
How this question sits across CE versions
Montpellier
You are here
Do you have a documented business case for all of these services?
Please describe how you approve and document your allowed inbound connections.
Danzell
View →
Please describe how you approve and document your allowed inbound connections.
Does your organisation meet this requirement?
Answer 30 plain-English questions and find out exactly where you stand across all 5 Cyber Essentials control areas — with a prioritised list of what to fix first.