A firewall holds a list of rules, and the list usually makes sense only to whoever wrote it. When that person is away, or leaves, nobody else can say why a rule exists or whether it is still needed. A plain-language rule record solves that. It sits beside the configuration and explains each rule in words.
One thing to be clear about before you start. Nothing here tells you whether any document satisfies anything, and nothing here identifies what you are obliged to produce. Which frameworks, standards and obligations apply to an organization varies by organization, by industry and by jurisdiction, and working out which ones apply to you belongs with a qualified professional who knows your situation. This article covers the record only. It does not describe how to configure a firewall. The configuration itself is the job of whoever manages your network, working with qualified professionals.
What the record is for
The record answers the questions people ask about a rule long after it was made: what is it for, who wanted it, who said yes, and is it still needed. It gives a reviewer, a new team member or an outside advisor a way in that does not depend on reading the configuration.
What to record for each rule
| Field | What to write |
|---|---|
| Rule name | The name or reference used in the configuration |
| Purpose | One plain sentence on what the rule allows or stops, and why |
| Requested by | The person or team that asked for it |
| Approved by | The person who approved it, and the date |
| Business owner | Who to ask if the rule’s purpose is questioned |
| Temporary or standing | Whether it was meant to be removed, and when |
| Last reviewed | The date of the most recent review and its outcome |
Write the purpose for a reader who does not work in IT. “Lets the accounting office reach the payroll system” is better than a line of technical shorthand.
How to build it
- Export the current rule list. Ask whoever manages the firewall for a copy of the rules as they stand today.
- Fill in one row per rule. Work with that person to write the purpose of each rule in plain words.
- Find the owners. For each rule, name the person who would be asked about it.
- Flag the unknowns. Any rule nobody can explain goes on a list of open questions with an owner. Decisions about it belong with whoever manages the network.
- Store it with your other records. Keep versions so you can see how the list has changed.
Keeping it current
Make updating the record part of every rule change: no change is complete until its row is written. Review the whole record on a cadence your organization chooses, and record each review with its date and outcome. Temporary rules deserve particular attention, because they are the ones most often forgotten.
What the record is not
The record explains intent. It does not show that a rule is set up correctly or that the network is safe, and it is not a credential. Those judgments belong with a qualified professional.
When you are ready to gather the documents that sit alongside this one, work through the Trust Center Document Checklist page on this site and fill the gaps one document at a time.