Serviced office, co-working space, hot desks — whose firewall is it anyway?
Thousands of small organisations work from serviced offices, co-working spaces and coffee shops where somebody else runs the network. The firewall questions in Cyber Essentials look impossible from that chair — they aren't. The standard already has an answer: when you don't control the network, the boundary moves to the device. Here's how that works and exactly what to put.
The principle: untrusted network = software firewalls
Cyber Essentials treats a network you don't control exactly like a home network or café Wi-Fi: untrusted. The protection the standard wants is then the software firewall on each device — Windows Defender Firewall, macOS's firewall — switched on, configured, and not full of forgotten “allow” rules. You are not marked down for renting a desk; you're assessed on the devices you actually control.
How to answer the firewall questions
- Describe reality: “we operate from a serviced office / co-working space; the network is managed by the provider and treated as untrusted; all organisational devices rely on enabled, configured software firewalls.” Assessors read that as competence, not weakness.
- Check every device: firewall on, no blanket inbound allows, password required to change settings. Ten minutes per machine.
- Remote access: if anything is reachable from the internet (a NAS, a server, remote desktop), that's where boundary questions get real — in a serviced office the honest answer is usually “nothing is”, and cloud services carry the load instead (which is where the MFA rule takes over).
The co-working checklist
- Software firewall enabled and configured on every laptop — the core answer.
- Devices don't trust the office network: no shared drives mapped across it, printing via the provider's approved route.
- Screen-lock on idle everywhere — shared space makes physical basics part of the story.
- VPN if you want belt-and-braces on open Wi-Fi — good practice, not a certification requirement.
- Provider-supplied kit (a meeting-room PC you actually use for work) — either keep organisational data off it entirely or accept it into scope; there's no half-way.
Plus adds an on-site/remote technical audit — still workable from a serviced office, provided each device stands on its own: software firewall, hardened configuration, supported OS. The assessor tests your machines, not your landlord's switch cupboard.
Net position: a serviced-office organisation with clean devices and MFA on its cloud services is often easier to certify than a traditional office dragging an elderly server — the estate is smaller and the boundary is honest. The trap isn't the desk you rent; it's the one unmanaged laptop nobody checked.
Renting desks? See if your devices pass today
The free readiness check covers the firewall, device and cloud questions the way an assessor reads them — five minutes, no sign-up, built for organisations without an IT department.
Take the readiness check · hello@passcyber.co.uk
PassCyber is a trading name of Edwards Bros (Spaldwick) Ltd