Penetration Testing
Firewall Security Audit: Configuration Review UK
A firewall security audit (firewall configuration review) is a line-by-line review of your rule base and host builds that finds over-permissive rules, missing egress filtering and insecure defaults before an attacker does. We check rules against PCI DSS Requirement 1 and builds against CIS Benchmarks, and as a PCI SSC-approved QSA company we document the work as assessment evidence.
Prefer to talk? Call +44 161 523 5276
- Firewall rule base review
- CIS Benchmark host reviews
- Mapped to PCI DSS Requirement 1
Trusted by banks, payment providers and global brands
On this page
- Firewall security audit: what's included
- What does a firewall audit review?
- Firewall rule review checklist
- Firewall security audit vs firewall penetration test
- How long does a firewall audit take?
- How is a firewall configuration review carried out?
- Why choose Sovereign Secure for a firewall security audit?
- Frequently asked questions
Overview
What is a firewall security audit?
The short answer
A firewall security audit is a line-by-line review of your firewall rule base and host builds. It looks for over-permissive and redundant rules, missing egress filtering, weak segmentation and insecure defaults, checks the rules against PCI DSS Requirement 1 and server and workstation builds against CIS Benchmarks, then ranks the fixes by risk.
A firewall audit, also called a firewall configuration review or firewall rule review, examines your firewall rules and host builds directly, rather than probing them from outside. Working from the configuration gives complete visibility: every rule, including the ones that are never triggered from where a tester happens to sit, and every setting on a hardened build.
We review firewall rule bases for over-permissive rules, unnecessary access, missing egress filtering and drift from a clean baseline, mapping the results to PCI DSS Requirement 1. For hosts, we assess server and workstation builds against CIS Benchmarks to confirm they are hardened and free of insecure defaults.
A firewall review is not the same as a firewall pentest. The review shows what the rules allow and why; a test shows what actually gets through. Pair it with external penetration testing to see your perimeter from the internet, and with network and infrastructure penetration testing to check the rules that separate internal zones.
For PCI DSS, rule-base review also underpins segmentation. If your firewalls keep the cardholder data environment separate, the segmentation tests in PCI DSS penetration testing confirm the rules hold in practice. New to testing? Our guides to what penetration testing is and the types of penetration testing show where a configuration review fits.
What's included
Firewall security audit: what's included
A review can cover firewall rule bases, host builds, or both.
- 01
Firewall rule base review
A full review of your firewall rules for over-permissive access, redundancy and risk.
- 02
Mapped to PCI DSS Requirement 1
Assessment of firewall and network controls against PCI DSS Requirement 1 expectations.
- 03
CIS Benchmark host reviews
Assessment of server and workstation builds against CIS Benchmarks for the relevant platform.
- 04
Egress and segmentation checks
Review of outbound filtering and the rules that enforce segmentation between network zones.
- 05
Rule base hygiene
Identification of redundant, shadowed, expired and undocumented rules that add risk and complexity.
- 06
Hardening assessment
Review of host services, accounts, patching and settings against a secure baseline.
- 07
Prioritised recommendations
Clear, ranked recommendations to tighten configurations without breaking operations.
- 08
Retest support
A review of remediated configurations can be scoped into your proposal, with the report updated to show them closed.
What we test for
What does a firewall audit review?
Coverage spans the firewall rule base and the host build standard, whether the rules sit on a hardware firewall, a virtual appliance or cloud security groups.
Firewall rule base
The rules that control what traffic is allowed, and whether they are as tight as they should be.
- Over-permissive and any-any rules
- Unnecessary inbound access
- Rules allowing untrusted sources
- Undocumented or unjustified rules
- Rules inconsistent with policy
PCI DSS Requirement 1
Firewall and network controls checked against PCI expectations.
- Controls around the cardholder data environment
- Justification and documentation of rules
- Inbound and outbound traffic restrictions
- Segmentation of in-scope networks
- Review-cycle and change evidence
Egress and segmentation
Outbound control and enforcement of network boundaries.
- Missing or weak egress filtering
- Segmentation between zones
- Isolation of sensitive networks
- Management-traffic restrictions
- Default-deny posture
Rule base hygiene
The clutter that accumulates in a rule base and adds risk.
- Redundant and duplicate rules
- Shadowed and unreachable rules
- Expired and temporary rules left in place
- Overly broad object and service groups
- Missing rule descriptions and ownership
Host build and hardening
Server and workstation builds checked against a secure baseline.
- Configuration against CIS Benchmarks
- Unnecessary services and features
- Account and privilege configuration
- Patch and update status
- Logging, auditing and secure settings
Firewall rule review checklist
A firewall rule review works through every rule and setting and asks three questions: is it needed, is it justified, and is it as narrow as it can be? The checklist shows the main checks, the risk each one addresses and where PCI DSS v4.0.1 or other recognised guidance expects it, so you can brief your network team before an audit.
| Check | Risk it addresses | Reference |
|---|---|---|
| Every allowed service, protocol and port has a documented business need and an owner | Rules nobody can explain stay open long after the system they served has gone | PCI DSS 1.2.5 |
| No any-to-any, any-source or any-port rules where a narrower rule would do | One broad rule can expose a whole network | PCI DSS 1.3.1 and 1.4.2; CIS Benchmarks for firewalls |
| Insecure services such as Telnet, FTP and unencrypted management are blocked or carry extra controls | Credentials and data cross the network in clear text | PCI DSS 1.2.6 |
| Traffic into and out of the cardholder data environment is limited to what is needed, and everything else is denied | An attacker can reach card data from other zones, or send it out freely | PCI DSS 1.3.1 and 1.3.2 |
| Outbound (egress) filtering applies to other zones too, not only the cardholder data environment | Malware calls home and data leaves without being blocked | NIST SP 800-41; ISO 27001 A.8.20 |
| A firewall sits between every wireless network and the cardholder data environment | A weak Wi-Fi network becomes a route to card data | PCI DSS 1.3.3 |
| Anti-spoofing is enabled and internal addresses are not disclosed | Forged source addresses get past address-based rules | PCI DSS 1.4.3 and 1.4.5 |
| Redundant, shadowed, duplicate and expired temporary rules are removed | Clutter hides risky rules and makes every change more error-prone | PCI DSS 1.2.7 (review at least every six months) |
| Management interfaces are reachable only from admin networks, over encrypted connections | Anyone who reaches the console can rewrite the rules | PCI DSS 2.2.7; CIS Benchmarks for firewalls |
| The running and saved configurations match, and configuration files are protected | Unrecorded changes go unnoticed, and a restart can bring back old rules | PCI DSS 1.2.8 |
| Rule changes go through change control, and network and data-flow diagrams are current | Undocumented changes erode the rule base over time | PCI DSS 1.2.2, 1.2.3 and 1.2.4 |
| Firewall software is supported and patched, and logs reach a central system | Known firewall vulnerabilities, and attacks nobody sees | PCI DSS 6.3.3 and 10.2; CIS Benchmarks for firewalls |
The same checks support Cyber Essentials, whose firewall control expects unauthenticated inbound connections to be blocked by default and every opening to be approved and documented with a business need, and ISO 27001:2022 Annex A 8.20 (networks security) and 8.22 (segregation of networks). CIS publishes benchmarks for common firewall platforms, including Cisco, Check Point, Fortinet and Palo Alto Networks.
Firewall security audit vs firewall penetration test
An audit reads the rules; a penetration test sends traffic at them. The audit finds rules that are wrong but not yet exploited, and the test proves what actually gets through, so the two work best together.
| Aspect | Firewall security audit | Firewall penetration test |
|---|---|---|
| Question it answers | What do the rules allow, and should they? | What actually gets through from a given position? |
| How it works | Exported rule bases and configurations reviewed line by line | Traffic sent from the internet or between zones, with exploitation of anything reachable |
| Finds well | Over-broad, redundant and undocumented rules, weak management access and insecure defaults | Real exposure, including services behind rules that look safe on paper |
| Coverage | Every rule and setting, including ones a tester would never trigger | The paths reachable from the test position |
| PCI DSS | Requirement 1, including the six-monthly review in 1.2.7 | Requirement 11.4, including segmentation testing in 11.4.5 |
To test the perimeter from the internet, pair the audit with an external penetration test; to prove that segmentation holds, add PCI DSS penetration testing.
How long does a firewall audit take?
Most firewall audits take days rather than weeks. A single firewall or clustered pair with a modest rule base can usually be reviewed and reported within a few days, while estates with many firewalls, large and long-lived rule bases or several host build standards take longer. The number and complexity of rules matter more than the number of devices, and we confirm the timeline in your proposal.
| Driver | Effect on duration |
|---|---|
| Number of firewalls and platforms | Each platform has its own configuration format and benchmark, though a clustered pair is reviewed once |
| Size and age of the rule base | Large, old rule bases with many objects and groups take longest to untangle |
| Documentation | A rule register with business justifications and owners speeds the review up; without one, rules have to be explained in a workshop |
| Host build standards | Each server or workstation build reviewed against a CIS Benchmark adds time |
| PCI DSS mapping | Mapping findings to Requirement 1 and confirming the cardholder data environment boundary adds a short step |
Our penetration testing cost guide explains how days turn into a price, and the quote form collects the number of firewalls, platforms and rules we need to scope your audit.
How it works
How is a firewall configuration review carried out?
- 1
Scoping
We agree the firewalls, host builds and platforms in scope, and fix the price.
- 2
Information gathering
We collect rule base exports, configurations and build standards, and understand your network architecture.
- 3
Review
We review firewall rules against PCI Requirement 1 and best practice, and host builds against CIS Benchmarks.
- 4
Reporting
A report with prioritised findings, the rationale for each, and clear recommendations.
- 5
Debrief
A walkthrough with your team covering the findings and the changes to make.
- 6
Retest
We review the remediated configurations and reissue the report showing findings closed.
A review reads the rules directly, while a penetration test probes them from outside through the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.
Why Sovereign Secure
Why choose Sovereign Secure for a firewall security audit?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Firewall rules reviewed against PCI DSS Requirement 1 by a QSA company, so evidence lines up.
- Host builds assessed against CIS Benchmarks, the recognised hardening standard.
- Complete visibility from the configuration, catching issues an external test may never trigger.
- Recommendations that tighten security without breaking operations.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Can you audit cloud security groups as well as hardware firewalls?
Yes. The same rule-by-rule review applies to cloud network controls, such as AWS security groups and network ACLs, Azure network security groups and Google Cloud firewall rules, as well as hardware firewalls and virtual appliances. For identity, storage and the wider cloud configuration, pair it with cloud penetration testing.
Does this map to PCI DSS Requirement 1?
Yes. Requirement 1 covers network security controls, including firewall and router configurations. We review your rule base against it, and as a QSA company we document the work so it supports your assessment.
What are CIS Benchmarks?
CIS Benchmarks are widely used secure-configuration baselines for operating systems, applications and devices. We assess your host builds against the relevant benchmark to confirm they are hardened and free of insecure defaults.
What do you need from us for a firewall configuration review?
Firewall rule base exports or configuration files, host build standards or access to representative systems, and network diagrams. Read access is usually enough. We confirm the detail during scoping.
Will you change our configurations?
No. We review and recommend; your team makes the changes, so you keep full control and can plan them around operations. We are happy to advise during remediation and review the result.
How often should configurations be reviewed?
At least every six months if the firewalls protect card data, because PCI DSS Requirement 1.2.7 expects network security control configurations to be reviewed that often; otherwise at least annually. Review again after any significant change, and we can align the timing with your other testing and assessment activity.
What is the difference between a firewall review and a firewall pentest?
A firewall review reads the rule base and reports what it allows and why, while a firewall pentest attacks from outside or between zones to show what actually gets through; the comparison table above sets out the differences.
How much does a firewall configuration review cost?
The price depends on the number of firewalls and rules, how many host build standards we assess and whether PCI DSS Requirement 1 mapping is needed. Our penetration testing cost guide explains how days are estimated, and our firewall review quote form gets you a fixed price.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- Network & infrastructure testingNetwork penetration testing for UK firms: external perimeter, internal network and Active Directory attack paths, plus PCI DSS segmentation tests. Get a quote.
- External Penetration TestingExternal penetration testing of your internet-facing perimeter by a PCI QSA company: VPN, email, web and cloud, mapped to PCI DSS 11.4.3. Get a fixed quote.
- PCI DSS penetration testingPCI compliance penetration testing to PCI DSS Requirement 11.4 by a QSA company: internal, external, application and segmentation pen tests with ROC-ready reports.
- Vulnerability scanningVulnerability scanning services and vulnerability assessment services: internal, external and cloud scans, triaged findings, rescans and PCI ASV scans via a partner.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]