NO-01—Network Policy Enforcement Points

>Control Description

Network traffic to and from untrusted networks passes through a policy enforcement point; firewall rules are established in accordance with identified security requirements and business justifications.

Theme

Technology

Type

Preventive

Policy/Standard

Network Security Standard

>Implementation Guidance

1. Ensure that necessary process and documentation are established for network traffic management. 2. Ensure necessary requirements are defined for managing network traffic to and from untrusted networks in the policy. 3. Ensure firewall rules are established to determine specific configuration requirements have been documented for network devices within the policy.

>Testing Procedure

1. Inspect Network Security Policy and/or Standard to determine whether requirements have been defined for managing network traffic to and from untrusted networks. 2. Review firewall rules to ensure they are defined according to the requirements of the organization.