Cyber Essentials Home Working: Are Home Routers and Wi-Fi in Scope?
Published 13 November 2026
What the scope diagram shows
The NCSC's Requirements for IT Infrastructure v3.3 include a diagram of a typical scope. The home worker's internet router supplied by their ISP sits outside the organisation's boundary. That reflects reality: you do not control it, and it is shared with the rest of the household.
Because the home router cannot be relied on as your firewall, the protection moves to the device. That is why the firewall requirement applies to home-working devices directly.
When a home router is in scope
If the organisation provides and manages a router or firewall in an employee's home, for example a dedicated business broadband line or a managed firewall appliance for a senior engineer, it is organisational equipment and should be treated as in scope. It then needs the usual firewall controls: changed default password, admin interface not exposed to the internet, unnecessary services blocked, and firmware kept up to date.
The home-working device is still in scope
- Supported operating system, with CE-required vulnerability fixes installed within 14 days.
- Malware protection.
- Secure configuration: no unnecessary software or accounts, screen lock enabled.
- User access control: individual account, standard user for daily work.
- A software (host-based) firewall enabled and configured, especially for use on untrusted networks such as home Wi-Fi and public hotspots.
Our Cyber Essentials firewall requirements guide covers host firewall settings in more detail.
Personal devices used at home
A personal laptop or phone used to access organisational data or services, such as work email, Teams or files, is in scope under BYOD. It needs to meet the same controls as a company device, including a host firewall where applicable. If you cannot apply the controls, the safer option is to stop that device accessing organisational data. See Cyber Essentials and BYOD.
Does a VPN take the device out of scope?
No. A VPN changes how traffic reaches your systems, but the device at the end of it is still a computer that runs software, connects to networks and can be attacked. It still needs updates, malware protection, secure configuration and a host firewall. A corporate VPN can bring the home device's traffic inside your network boundary, which makes the device's compliance even more important, not less.
Worked examples
| Example | In scope? | What to check |
|---|---|---|
| Company laptop used at home on the ISP router | Laptop: yes. ISP router: no. | Host firewall on, updates, malware protection, standard user account. |
| Personal laptop with work email in a browser | Yes (BYOD) | Supported OS, updates, malware protection, firewall, screen lock. Or block access from unmanaged devices. |
| Personal phone used only for the authenticator app | Can be out of scope as an MFA-only device where NCSC v3.3 allows | Confirm it is not also used for work email or files. |
| Managed firewall supplied to a home office | Yes | Default password changed, admin interface protected, firmware updated. |
For the wider remote-working picture, including cloud access and device management, see Cyber Essentials for remote workers.