Whether it is PCI DSS, HIPAA, SOC 2 or a cyber-insurance questionnaire, the firewall is where the questions start. Most findings are not missing technology — they are housekeeping nobody owned.
What an auditor actually looks at
An assessor rarely asks to see the box. They ask for evidence: what the firewall allows, who changed it, what it logged, and how current it is. Four artefacts cover the majority of that conversation.
- A documented rule base. Every allow rule has an owner, a reason and a review date — not a comment field reading “temp, do not delete”.
- Logs you can actually produce. Traffic and admin logs retained for the period your framework requires, and searchable when asked.
- A current firmware level. Known-vulnerable versions are the fastest finding an auditor can write.
- Controlled remote access. VPN and admin access behind MFA, with leavers removed the day they leave.
“Most audit findings at the perimeter trace back to three things: stale rules, no log retention, and remote access nobody reviews.”
The four checks worth doing first
Frameworks read as intimidating, but the work in front of an audit is short and repeatable. These four checks close the gaps assessors find most often.
1. Prune the rule base
Firewall policies grow by accretion: a rule opened for a project in 2021, a permit-any added during an outage. Remove what no longer has an owner, tighten what is broader than it needs to be, and record the reason for everything that stays.
2. Keep firmware and signatures current
UTM services — intrusion prevention, gateway antivirus, content filtering — are only as good as their last update. Patching should be scheduled, verified and reported, not left to whoever remembers.
Key takeaways
- Every allow rule needs an owner, a reason and a review date.
- Retain traffic and admin logs for the period your framework requires.
- Put VPN and admin access behind MFA, and remove leavers same-day.
- Schedule firmware and UTM signature updates, then verify them.
Where a managed firewall fits
None of this is difficult — it is simply continuous. A managed firewall service owns the rule base, keeps firmware and UTM services current, retains the logs, and hands you the evidence pack at audit time, so the perimeter stops being a scramble and becomes something already handled. See what the managed plan covers.
All guides