Cyber Essentials 3: firewalls and secure configuration that match reality

Prepare a safe change path

Use the scope register from part 2. Group systems by how they are configured: managed Windows laptops, Macs, phones, office networking and cloud infrastructure may need different evidence. Identify the person authorised to change each group and how you would recover remote access if a rule goes wrong.

Start with a representative pilot device and a documented rollback. Do not change all firewall profiles or administrative routes at once. If a system has no tested recovery route, fix that dependency before attempting a change that could lock you out. Preserve the old configuration in a protected location without exporting unnecessary secrets.

Explain each exposed service

The scheme requires firewall protection for in-scope devices and blocking unauthenticated inbound connections by default. A business-required exception needs a documented reason and approval; remove it when it is no longer needed. This applies to relevant cloud and host boundaries as well as the office appliance.

Export the effective inbound rules and compare them with the service inventory. For each allowance, record source, destination, protocol/port, purpose, owner and review date. The review date is our suggested operating practice, not a universal CE interval. Ask the service owner to explain the need in business terms before retaining an old “temporary supplier access” rule.

At fictional Merefield, a retired file-transfer service still has an inbound rule. The service owner confirms it has been replaced. IT checks dependencies, removes the rule through change control and verifies the expected service still works. The useful evidence is the original finding, approval, changed rule and verification result—not a screenshot of an empty rule list from a different firewall.

Firewall administration deserves its own check. Replace default or guessable administrative credentials, or disable remote administration. The requirements restrict internet-accessible administration unless there is a documented business need and either MFA or a small trusted IP allow list combined with properly managed password authentication. Prefer a restricted administration path; verify the exact permitted arrangement against v3.3 rather than treating a long password as sufficient in every case.

Test the endpoint away from the office

A laptop can be protected at the office and exposed elsewhere. Check host-firewall operation on untrusted networks using an authorised, isolated test network and a low-impact check performed by someone who understands the environment. Do not scan other customers on a hotel or café network.

Compare the policy in the management console with the effective state on the endpoint. A profile can be assigned but not applied because the device has not checked in, has conflicting settings or belongs to the wrong group. Record the device ID, timestamp and actual result. Investigate disagreement; the policy's name is not the control.

For hosted infrastructure, trace the complete path: cloud security rules, host firewall, public addresses and exposed services. A private subnet label does not establish isolation if a load balancer, tunnel or management tool provides access. Agree any external testing with the asset owner and provider before it happens.

Remove what should not be there

Secure configuration includes removing or disabling unnecessary accounts, software and services, changing default or easily guessed passwords and preventing automatic file execution without authorisation, including relevant download and removable-media behaviour. Users must authenticate before accessing organisational data or services. Device locking also matters.

Build a baseline in plain language alongside the configuration profile. For example: which local accounts exist, which applications are approved, which services are enabled and who may alter them. Compare an older device and a recently provisioned one. An image built six months ago can drift from the intended baseline even when the new-device process is sound.

Device-unlock rules are not interchangeable with account sign-in rules. Under v3.3 a device-only PIN or password has a minimum of six characters and requires the specified brute-force protection. Where that credential also authenticates an account, the full authentication requirements apply. Biometric unlocking still needs an appropriate fallback. Read the relevant platform behaviour instead of assuming every six-digit PIN satisfies every requirement.

Keep a baseline exception honest

A business exception cannot turn an unmet scheme requirement into a pass. If a required service prevents compliance, the sponsor must decide how to replace, reconfigure or legitimately segregate it. Keep the status open while that work is incomplete.

Exercise: prove one baseline end to end

Choose one device from each management group. Compare its installed applications, active accounts, firewall state and locking behaviour with the intended baseline. Write down differences and establish whether they affect the rest of the group. The exercise is a diagnostic sample, not permission to leave the rest of the estate unchecked.

You should finish with controlled baselines, a rule register, pilot results and a plan for proving coverage across scope. Part 4 tackles the condition that most quickly goes stale after a successful setup: software support and required security updates.

Check your understanding