Willow A4.5

Do you have a process to manage your firewall?

Section A4: Firewalls  ·  Cyber Essentials Willow

New in Willow — replaces and expands upon the Montpellier question about external services.

What this question is really asking

Describe your process for managing firewall rules — how rules are requested, approved, documented, and reviewed. Willow introduced this to address the common failure of organisations having correctly configured firewalls at setup but with no ongoing process to keep them compliant over time.

What satisfies this requirement

Yes or No — if Yes, a written description is also required

Your firewall may be configured to allow external access e.g. VPN server, mail server, FTP, customer service ('opening a port'). You need to show a business case for this.

Check how you answer this in the CE Explorer
Free tool — all 288 questions mapped across every CE version.
Open CE Explorer

What to prepare before your assessor visit

This process question catches many organisations unprepared. Having a well-configured firewall today is not enough if there is no process governing how it stays that way. An assessor will ask: who can request a firewall rule change? Who approves it? How is it documented? If the answer is 'we do it informally', that is a finding — even if the firewall configuration itself is correct.

How this question sits across CE versions

Willow You are here
Do you have a process to manage your firewall?
Montpellier View →
Do you have any services enabled that can be accessed externally from your internet router, hardware firewall or software firewall?
Danzell View →
Do you have a process to manage your firewall?

Related policy templates

Getting certified means having documentation to back it up. These policy templates cover the controls this question tests.

Network Security Policy
Covers boundary and host-based firewall requirements, rule management, and network access…
← Previous
A4.4
Do you change your firewall password when you know or suspect it has …
Next →
A4.6
Have you reviewed your firewall rules in the last 12 months?

Does your organisation meet this requirement?

Answer 30 plain-English questions and find out exactly where you stand across all 5 Cyber Essentials control areas — with a prioritised list of what to fix first.

Check my readiness → Explore all questions first