Which activity supports verifying that firewall rule-set reviews occur at least every 6 months per 1.1.7?

Which activity supports verifying that firewall rule-set reviews occur at least every 6 months per 1.1.7?

• A. Examine documentation relating to rule set reviews & interview responsible personnel to verify reviews occurred at least every 6 months.
• B. Only rely on automated alerts.
• C. Only review the latest change logs.
• D. Ask vendors for confirmation.

Answer: (A)

Verifying that firewall rule-set reviews occur on a six-month cadence requires evidence that the reviews actually happened, when they occurred, and who performed them. Examining documentation that records each rule-set review and interviewing the individuals responsible provides concrete proof of both the timing and the execution of the reviews. This approach combines documentary evidence with direct confirmation, satisfying the requirement that reviews take place at least every six months and that there is accountable ownership. Relying on automated alerts doesn’t prove a review was conducted; alerts track events, not the formal review process. Focusing only on the latest change logs shows what changed recently but doesn’t demonstrate a periodic, comprehensive review. Asking vendors for confirmation externalizes the control and doesn’t establish internal adherence to the six-month schedule.

Verifying that firewall rule-set reviews occur on a six-month cadence requires evidence that the reviews actually happened, when they occurred, and who performed them. Examining documentation that records each rule-set review and interviewing the individuals responsible provides concrete proof of both the timing and the execution of the reviews. This approach combines documentary evidence with direct confirmation, satisfying the requirement that reviews take place at least every six months and that there is accountable ownership.

Relying on automated alerts doesn’t prove a review was conducted; alerts track events, not the formal review process. Focusing only on the latest change logs shows what changed recently but doesn’t demonstrate a periodic, comprehensive review. Asking vendors for confirmation externalizes the control and doesn’t establish internal adherence to the six-month schedule.