FW.7 Restrict Firewall Administrative Interface from the Internet
Block internet access to the firewall administrative interface unless there is a clear documented business need, and where allowed protect it with multi-factor authentication or a restricted IP allow list combined with m
3
artefacts
2
held by a system
0
at each review
easy
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Firewall management-interface configuration export · Cloud console / configuration management
- MFA enrolment evidence or IP allow list definition for the admin interface · Identity provider / directory
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Documented business need and approval for any internet-facing admin access · Document repository
First move
Automate the pull from your Cloud console / configuration management. Configuration snapshots and change history from the cloud console or IaC repository, diffed against the baseline.
Common gaps auditors find
- router or firewall web admin reachable from the internet with password only
- allow list too broad or never reviewed
- business need asserted verbally with no record
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetFW.6 Host-Based Firewall for Remote Workers · MP.1 Anti-Malware Software Deployed