How often must firewall and router rule sets be reviewed?

How often must firewall and router rule sets be reviewed?

• A. Annually.
• B. At least every six months.
• C. Only when changes occur.
• D. Never.

Answer: (B)

Regular, semiannual review of firewall and router rule sets is essential to keep security controls aligned with the current network state. PCI DSS requires checking these rule sets at least every six months and after any significant network changes. This practice catches drift where rules become outdated, overly permissive, or not aligned with the actual segmentation and access needs, helping to maintain the principle of least privilege and reduce exposure. Choosing an annual review would risk letting changes or drift go unchecked for too long; reviewing only when changes occur could miss untracked adjustments; and never reviewing would leave the environment continually vulnerable.

Regular, semiannual review of firewall and router rule sets is essential to keep security controls aligned with the current network state. PCI DSS requires checking these rule sets at least every six months and after any significant network changes. This practice catches drift where rules become outdated, overly permissive, or not aligned with the actual segmentation and access needs, helping to maintain the principle of least privilege and reduce exposure.

Choosing an annual review would risk letting changes or drift go unchecked for too long; reviewing only when changes occur could miss untracked adjustments; and never reviewing would leave the environment continually vulnerable.