I have been going through the cyber essentials questionnaire and this one question is confusing me and I wondered if you could provide any insight into it for me.

in one of the 5 sections 'Boundary firewalls and internet gateways' this question arose.

Have you installed firewalls or similar devices at the boundaries of the networks in the Scope?

So my question is would that question be referring to network firewalls or something completely different? I know this question might be extremely simple but I am unable to find a definitive answer on what a boundary firewall is.

Thank you in advance.

3 Answers 3


Some of the Cyber Essentials wording is quite ambiguous, what this is asking about is firewalls on the boundary of the scope that you define at the outset, the scope of what you want to gain Cyber Essentials accreditation.

Cyber Essentials is self-certifying and is designed to give you a benchmark to measure against to ensure that you have the bare-minimum security controls on place.

Cyber Essentials + however is certified by an independent accreditation body, so defining what the boundary of your scope is becomes quite important.

The scope should be the first thing you define. There a lots of accreditation bodies out there, typically they will have services that will assist you with this process as well as helping to clear up the ambiguous language that you will find in the various Cyber Essentials documents and guidlines.

There are a number of ways you can define the scope, one common way is by dividing your network up into areas of administrative control.

So for example if you work for a global organisation but you are only responsible for the UK part of the network, then you can include the UK part of the network in the scope of what you want to be certified with Cyber Essentials and Cyber Essentials +.

In this instance the question is asking if you have firewalls in between the in-scope UK part of the network and the rest of the global network. This typically means full enterprise level firewall appliances and/or NGFWs (but not always). So effectively the Cyber Essentials accredited part of the network is separated from the un-accredited section by a firewall.

If your organisation is UK only and you want the entire network to be in-scope then the boundaries of your network scope will be the areas that breakout on to the internet. (Depending on how you define your scope this may or may not include the DMZ.)

Cyber Essentials covers a lot of things, it also covers host based firewalls, firewall reviews and firewalls in between in-scope network segments, but this questions specifically means on the boundary of the scope that will be defined at the outset of the Cyber Essentials process.

  • Hi, thank you very much for the detailed reply. if you are familiar with the cyber essentials questionnaire in relation to a small business would you mind if I dropped you a personal message? I am getting some experience shortly in this area but my lecturer for University hasn't really been of much help explaining what I actually need to do. Feb 8, 2017 at 14:21
  • CE is quite a broad church. If you are looking for an overview I would call one of the accreditation bodies as they will have subject matter experts that deal with this day in day out. If you explain you are a student, I’m sure you will find one that will be willing to give you some time to give you a high level overview. You can view a list of the bodies here; cyberessentials.org/list Feb 8, 2017 at 14:29

There's mainly two location where you can put firewalls:

  • At boundaries of your network, between your internal LAN and the Internet for example, classic firewall for IP access, usually Web Application Firewalls to expose HTTP applications to internet.
  • At core of your network, to prevent non admin users to access remote management of servers, in this case the firewall usually handle the routing between LAN subnets.

For WAN access (remote offices) the topology used (boundary or core) may vary depending on how the remote office is connected to central office (VPN over internet or private link) and on various factors like if the office will access internet through the central office or directly.

Mainly, a network boundary if where you stop to "trust" the network, usually because you can't administer it.


In addition to the previous answers, there is a 3rd "boundary" that is also becoming ever more important as more workers are mobile.

You may get people who never work on a corporate network and so the traditional boundaries no longer apply. In the past, these users might have been forced to use a VPN to connect back to the corporate network but this is quite inefficient and relatively expensive and so new designs are beginning to think about direct Internet connections.

In this case, the client computer should create it's own boundary that should also be considered and have an appropriately configured firewall.

You might also need to consider other boundary protections in the same way. They include Data Loss Prevention and Intrusion Protection. These are generally separate tools to a firewall wherever they are positioned.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .