What is the required review frequency for firewall & router rule sets per 1.1.7?

What is the required review frequency for firewall & router rule sets per 1.1.7?

• A. Every year.
• B. Every 6 months.
• C. Every 3 months.
• D. Never.

Answer: (B)

Regularly reviewing firewall and router rulesets keeps access controls aligned with current security policies and the actual network design. Over time, rules can drift, become outdated, or accumulate unnecessary permissiveness, which can create gaps or risks. By performing a review at least every six months, you catch these drift issues before they become problems and ensure that only authorized rules are in place. This minimum interval balances security oversight with operational practicality. Annual reviews would miss changes that happen in six months, while more frequent reviews are acceptable but not required by the standard.

Regularly reviewing firewall and router rulesets keeps access controls aligned with current security policies and the actual network design. Over time, rules can drift, become outdated, or accumulate unnecessary permissiveness, which can create gaps or risks. By performing a review at least every six months, you catch these drift issues before they become problems and ensure that only authorized rules are in place. This minimum interval balances security oversight with operational practicality. Annual reviews would miss changes that happen in six months, while more frequent reviews are acceptable but not required by the standard.