WiFi Compliance for Any Business: Cyber Essentials, Offices and Factories
• September 24, 2026 
WiFi compliance comes down to three questions. Is visitor traffic kept away from the systems your business runs on? Can you say who was on the network, and when? Does your setup meet whichever standard you are being assessed against? The third question is where most advice goes wrong, because the standards ask for very different things. Cyber Essentials asks almost nothing of your WiFi. A public sector security schedule can ask for named, logged, individually authenticated users. This guide separates the two, then covers the practical steps for any business running a visitor network, whether that is an office, a factory, a warehouse, a council building or a hotel.
Start with Cyber Essentials, because it asks less than you think
Cyber Essentials is the UK government-backed baseline for cyber security, run by the NCSC and IASME. Wireless is in the standard, but as a scoping question, not a control. Here is the entire passage on wireless devices:
“Wireless devices (including wireless access points) are:
Cyber Essentials: Requirements for IT Infrastructure v3.3
- in scope if they can communicate with other devices via the internet
- out of scope if it’s not possible for an attacker to attack directly via the internet (the Cyber Essentials scheme isn’t concerned with attacks that can only be launched within the signal range of the wireless device)
- out of scope if they are part of an ISP router at the home or remote location”
That parenthetical settles most of the questions people bring to this topic.
Does Cyber Essentials require you to change a shared office WiFi password? No. A shared password is a real weakness, and it fails higher-tier standards covered below, but an attacker who needs to be within range of your building is explicitly outside what this scheme concerns itself with. Change it anyway. Just do not tell an assessor you did it for Cyber Essentials.
WiFi Email Capture Service
Are you ready to start capturing customer email on your venues WiFi? Click the link below to learn more
Does it require WPA2 or WPA3? No. The letters “WPA” do not appear anywhere in the requirements document. Use WPA3 because it is the right thing to do.
Does it require a captive portal or guest network segregation? No. Segregation appears only as a way to shrink your scope:
“A sub-set is part of the organisation whose network is segregated from the rest of the organisation by a firewall or VLAN”
Cyber Essentials: Requirements for IT Infrastructure v3.3
Putting a visitor network on its own VLAN lets you treat it as a sub-set and exclude it from assessment. That is worth doing, and every mainstream controller does it for free. But it reduces what you have to prove. It does not make you compliant.
What Cyber Essentials does require, and where WiFi setups fail. The controls are device-level. Every in-scope device, including access points and controllers, needs a correctly configured firewall, and for the firewalls themselves you must:
Cyber Essentials: Requirements for IT Infrastructure v3.3
- “change default administrative passwords to a strong and unique password… or disable remote administrative access entirely”
- “prevent access to the administrative interface… from the internet, unless there is a clear and documented business need”
- “block unauthenticated inbound connections by default”
A default admin password on the WiFi controller is a far more common cause of failure than anything to do with guest access.
The requirement that catches WiFi platforms. It is not about the network at all:
“If your organisation’s data or services are hosted on cloud services, these services must be in scope.”
Cyber Essentials: Requirements for IT Infrastructure v3.3
“implement MFA, where available – authentication to cloud services must always use MFA”
Cyber Essentials: Requirements for IT Infrastructure v3.3
Any cloud-hosted WiFi platform that holds visitor data is a cloud service in your scope. So the assessor’s question is whether the admin login on that platform supports multi-factor authentication, and whether you can avoid shared or dormant admin accounts on it (“remove and disable unnecessary user accounts (such as guest…)”). Ask that of every vendor before you buy.
So, to be compliant for WiFi under Cyber Essentials: change the default admin password on your access points and controller, keep the controller’s admin interface off the internet, put visitors on their own VLAN to shrink scope, and check that any cloud WiFi platform you use supports MFA on its admin login. That is genuinely the list.
Separate visitor traffic from the systems your business runs on
Whatever the standard says, this is the step that protects you. If a visitor’s device shares a network segment with your finance system, your ERP, or in a factory your PLCs and building controls, one compromised phone is a foothold.
- Give visitors and contractors a dedicated VLAN, or a separate SSID mapped to one. UniFi, Meraki, Ruckus, Aruba and Omada all support this natively at no cost. You do not need extra software for it.
- Check that the visitor VLAN cannot reach internal address ranges, not just that it has a different name. As one sysadmin discussion puts it, a “separate” guest network still runs on the same hardware and talks to the same gateway, so the gateway “can be compromised and lead to lateral movement where none should be.”
- Apply the same thinking to contractors and delivery staff in a factory or warehouse as to visitors in an office lobby. They are on the same physical infrastructure that carries your operations.
Know who was on the network, and when
Segregation limits damage. It does not tell you who did what. The moment a security team, an auditor or a tender questionnaire asks “which person was using this IP address at this time?”, an open network or a shared password has no answer.
Identity-based logging fixes that by identifying each user before they reach the internet and recording the session against them.
- Replace the open or shared-password network with authenticated access. For visitors that usually means a captive portal that verifies an identity (a work email, a verified personal email, or a sponsor) before the controller lets the device through. For staff it means individual credentials, ideally tied to your directory rather than a shared key.
- Record, for every session, the person, the device address, the local IP the network gave it, the SSID or access point, and the start and end times. DHCP leases and controller logs give you the device. Only an authenticated portal or RADIUS accounting gives you the person behind it.
- Decide how long you keep those records and who can search them, and write both down. The record only helps if someone can find it during an incident.
This is where the standards diverge from Cyber Essentials. The DWP wireless standard SS-019, which public sector suppliers often inherit through a security schedule, requires guests to authenticate before reaching the internet, credentials that are unique and attributable to each guest, an acceptable use policy, and a log of who connected. Those requirements are real and specific, and they do need software. If your questionnaire names a standard like that, read the DWP SS-019 wireless standard itself next.
Where MyPlace fits
MyPlace is guest WiFi software built for hospitality first, where the same guest records also drive review generation and marketing. Offices and public bodies use the identity, access and logging side and leave the marketing switched off. That is a normal way to run it, and some organisations run it for that reason alone.
What it does for the compliance questions above:
- Visitors reach a portal and identify themselves with a verified email before the controller lets them through. Staff can sign in with their work email and a one-time link checked against your Microsoft Entra ID directory.
- Each session is recorded with the person, the device address, the local IP address the network gave the device, the SSID, and the start and end times. Take an IP from a log and get back to the person, or look up a person and see every session.
- Acceptance of your acceptable use policy is timestamped per person.
- Administrator accounts are individual, with separate permission levels, and every admin action is logged with the account, the action, the target, the time and the IP it came from.
What it does not do: it does not make you Cyber Essentials compliant, because no software does. It does not segment your network, because your controller already does that. It does not filter content or limit bandwidth. Those controls live on the controller or firewall, where they belong. Full detail on the product side is on the WiFi compliance feature page.
Frequently asked questions
How can I be compliant for WiFi under Cyber Essentials?
Change the default admin password on every access point and controller, keep the controller’s admin interface off the internet, put visitor devices on their own VLAN so they can be scoped out as a sub-set, and confirm that any cloud WiFi platform you use supports MFA on its admin login. The standard has no captive portal, WPA or guest-control requirement.
Does Cyber Essentials require me to change our shared office WiFi password?
No. The scheme states it “isn’t concerned with attacks that can only be launched within the signal range of the wireless device.” A shared password is still a weakness, it will fail higher-tier standards such as DWP SS-019, and you should replace it with individual credentials. It is just not a Cyber Essentials finding.
How can I tell which person was using a specific IP address on our guest WiFi?
Only if users were identified before they connected. DHCP and controller logs map an IP to a device address and a time. An authenticated captive portal or RADIUS accounting maps that device to a person. Without that layer, the answer is “a device”, not “a person”. With it, you search the IP and get the user, their session times and the access point they joined through.
What should guest WiFi software log for a security team?
The person’s verified identity, the device address, the local IP assigned, the SSID or access point, session start and end, and a timestamped acceptance of the acceptable use policy. It should also keep individual admin accounts and log administrator actions, since shared admin logins are themselves a compliance finding under Cyber Essentials.
Do factories and offices need a different approach from hotels and restaurants?
The controls are the same. What changes is what sits behind the visitor network. In a factory that may be PLCs and building systems, in an office finance and HR systems, in a venue the point of sale. Segment first, then decide whether you need identity logging based on the standards you are assessed against.
Which version of Cyber Essentials is this based on?
Cyber Essentials: Requirements for IT Infrastructure v3.3, published April 2026 by the NCSC and IASME. The scheme is updated annually, so check for a newer version before relying on any of this.
Source
Cyber Essentials: Requirements for IT Infrastructure v3.3, NCSC, April 2026. All Cyber Essentials quotations on this page are from that document.
