Firewall Rules/Security Groups
Provide images displaying the firewall rules and security groups in place for all of your in-scope production systems.
The evidence should demonstrate:
The source system
That inbound and outbound access is restricted to your in-scope production systems
Inbound traffic rules and security group configurations
Outbound traffic rules and security group configurations
Additional Guidance
If you do not restrict the inbound and/or outbound access to your in-scope production systems, explain why in the Evidence Description.
If you use a cloud service provider, you may have opted to use their firewall functionality. Each CSP implements firewall tools differently in order to filter network traffic to and from cloud resources:
AWS uses security groups and access control lists
Azure uses network security groups and virtual networks
GCP uses Google Cloud firewall rules
Common examples of firewall tools that are not cloud specific include:
Cisco ASA
Fortinet Fortigate
Palo Alto Networks Wildfire
Example Evidence
GCP
Azure
Associated Unified Control ID | Associated Framework Control |
CTRL-950 | LCL-41 |