What to Provide
An export or screenshot demonstrating the firewall rules or security groups in place for all of your in-scope production systems.
Evidence Format
Screenshots or exported images in a common image file type, such as .jpg, .png, or .pdf., exported data table or spreadsheet in a common data file type such as .xlsx or .cvs.
Additional Guidance
The evidence should demonstrate:
The source system
That inbound and outbound access is restricted to your in-scope production systems
Inbound traffic rules and security group configurations
Outbound traffic rules and security group configurations
If you do not restrict the inbound and/or outbound access to your in-scope production systems, explain why in the Evidence Description.
If you use a cloud service provider, you may have opted to use their firewall functionality. Each CSP implements firewall tools differently in order to filter network traffic to and from cloud resources:
AWS uses Security Groups and Network Access Control Lists (NACLs)
NOTE: The AWS Trusted Advisor report export demonstrates if any Security Groups are configured with unrestricted inbound access and can be provided as evidence to satisfy this ER. See ER-54 guidance.
Azure uses Network Security Groups (NSGs) and Virtual Networks
GCP uses Google Cloud firewall rules
Common examples of firewall tools that are not cloud specific include:
Cisco ASA
Fortinet Fortigate
Palo Alto Networks Wildfire
Example Evidence
GCP
Azure
Associated Unified Control ID | Associated Framework Control |
CTRL-950 | LCL-41 |