Manage firewall rules as a control

Editorial update: 21 September 2026. Introductory learning material.

A firewall allows or blocks traffic according to its configuration. It reduces certain exposures but does not guarantee that a device, account or permitted connection is safe.

• Document necessary connections and responsible owners.
• Review rules for unnecessary exposure and overly broad access.
• Keep supported firewall software and firmware updated.
• Protect administration and retain appropriate logs.
• Test changes and keep a recovery plan.

Coordinate firewall changes with the qualified administrator. Remote access also needs protected accounts, supported endpoints and an approved connection method.

Activity: Ask the owner of one externally accessible service to identify its business purpose and most recent rule review.

Reference: FTC cybersecurity guidance for small businesses. Check the source and your system provider’s current instructions before implementation.