CMS Pub. 100-17, ch. 117_systems_security, § 3.20

(Rev. 15.1; Issued: 07-17-25; Effective: 02-28-25; Implementation: 08-18-25)

Firewalls are key to preventing unauthorized and unwanted network traffic from entering or exiting

a network and for restricting network access as a means of enforcing least privilege access.

Firewalls accomplish this by using rulesets that determine which traffic is allowed to pass. The

CMS TRA requires firewalls to functionally separate internal network zones.

In accordance with the latest revision of NIST Special Publication 800-41, management shall

develop policies and procedures to periodically review firewall rulesets/configurations (both

internal and external facing) to ensure they remain compliant. Management should use a risk-based

approach for determining the frequency of the review for each firewall, but at a minimum, on a

yearly basis. Areas to address in the policies and procedures include, but are not limited to:

• Validating old or out-of-date rules are prevented from processing by commenting them out

or deleting them. Validating redundant rules are not active.

• Reviewing all rulesets/configurations to identify that change documentation or reference

information that describes the purpose are documented. Management should be able to

provide business justification for each active rule.

• Testing that changes do not break or bypass existing rulesets and function as intended.

• Documenting change management processes to confirm that rule changes were reviewed,

tested, and approved.

• Comparing current rulesets to secured backups to validate that no unauthorized changes

have occurred.

• Verifying known insecure protocols and potentially unnecessary IP addresses are being

restricted.

If MACs decide to automate their Firewall rulesets review, they should ensure the following are

included, at minimum:

- Identification of redundant, duplicate, and conflicting rules.

- Identification of overly permissive rules.

- Identification of insecure ports and protocols.

- Identification of rules that are no longer used.

Firewall ruleset reviews need to be documented and evidence of review maintained. The following

types of information are important to maintain with the evidence of review:

- Evidence of reports and/or documentation reviewed.

- Who reviewed the report and/or documentation, the result of the review, and when the

review was performed.

- Tickets or documentation generated for addressing issues identified.