Skip to main content

Pro audit program · v1.0

Firewall Rule Hygiene

Are your firewall rules documented, reviewed and free of any-any? A 7-question hygiene audit for perimeter + segmentation rules.

  • General target area
  • CIS Controls framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Are your firewall rules documented, reviewed and free of any-any? A 7-question hygiene audit for perimeter + segmentation rules.

Risks addressed

  • Critical Any-any rules allow unintended lateral movement
  • Medium Stale rules accumulate as systems are decommissioned
  • Medium No audit trail of rule changes
  • High Implicit allow at the end of the rule base

Controls (7)

  1. Rule base reviewed at least annually

    High

    Firewall, network access control lists (ACLs), router rules, and similar packet-filtering rule bases must be formally reviewed at least annually to ensure they remain aligned with current business needs, security policies, and threat landscape. Over time, rule sets accumulate obsolete,…

    How to test + evidence

    Testing procedure: Inspect last firewall review minutes; confirm owners + decisions documented.

    Evidence to collect: Review report.

  2. No any-any allow rules

    Critical

    This control prohibits the configuration of overly permissive firewall or network access control list (ACL) rules that allow traffic from any source to any destination on any protocol or port (any-any-any rules). Such rules effectively bypass network segmentation and access…

    How to test + evidence

    Testing procedure: Filter the rule export for source=any dst=any allow. Expect zero (or documented exceptions).

    Evidence to collect: Rule export + exception register.

  3. Rules tied to a business owner / ticket

    Medium

    This control requires that firewall rules, access control lists, network security group rules, and similar network policy configurations be linked to identifiable business owners and tracked via formal ticketing systems (e.g., ServiceNow, Jira, Remedy). Each rule must reference a business…

    How to test + evidence

    Testing procedure: Spot-check 10 rules; each must reference a ticket + owner.

    Evidence to collect: Rule-to-ticket mapping.

  4. Unused rules removed quarterly

    Medium

    This control requires organizations to review and remove unused firewall rules, access control list entries, or security policy rules on a quarterly basis. Over time, rules accumulate as systems are deployed, modified, or decommissioned, creating bloat that obscures active security…

    How to test + evidence

    Testing procedure: Verify hit-counter analysis and removal of rules with zero hits for >90 days.

    Evidence to collect: Rule-usage report.

  5. Logging enabled on deny + critical allow rules

    High

    This control ensures that firewall and network security device rules are configured to generate log entries whenever traffic is denied, and for designated critical allow rules (e.g., administrative access, privileged service ports, external database connections). Logging on deny rules captures…

    How to test + evidence

    Testing procedure: Confirm logging enabled and forwarded to SIEM.

    Evidence to collect: Logging config + SIEM source.

  6. Segmentation between user and server VLANs

    High

    This control requires logical network isolation between user workstations (client devices) and server infrastructure through separate Virtual Local Area Networks (VLANs). VLANs enforce Layer 2 segmentation so that broadcast domains, ARP requests, and direct peer communication are restricted between user…

    How to test + evidence

    Testing procedure: Verify ACLs prevent direct user->server traffic except for documented services.

    Evidence to collect: Network diagram + rule export.

  7. Default-deny posture

    Critical

    Default-deny posture establishes network, application, and system access control policies that implicitly block all traffic, connections, or actions unless explicitly permitted by rule. This approach inverts traditional permissive models by requiring administrators to affirmatively allow each necessary flow or behavior.…

    How to test + evidence

    Testing procedure: Final rule is default-deny; no implicit allow at the end.

    Evidence to collect: Rule export — last rule.