# Plant Firewall Rule Review Worksheet

> Source: https://netray.co/tools/plant-firewall-rule-review-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Review each firewall rule between office, plant and cell zones, flag stale entries and record keep, tighten or remove decisions.

## Category

compliance-legal

## Industry

Discrete Manufacturing

## Audience

- IT manager
- Network engineer
- Security officer

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### Rule ID

**Key:** rule

**Type:** text

#### Source zone

**Key:** src

**Type:** select

**Options:**

- Corporate
- Plant IT
- Cell or OT
- DMZ
- Vendor VPN
- Internet

#### Destination zone

**Key:** dst

**Type:** select

**Options:**

- Corporate
- Plant IT
- Cell or OT
- DMZ
- Vendor VPN
- Internet

#### Service or port

**Key:** service

**Type:** text

#### Business owner

**Key:** owner

**Type:** text

#### Days since last hit

**Key:** last_hit

**Type:** number

#### Stale flag

**Key:** stale

**Type:** number

**Expr:** if(gt(last_hit, 180), 1, 0)

**Format:** integer

#### Decision

**Key:** decision

**Type:** select

**Options:**

- Keep
- Tighten
- Remove
- Investigate

**Rows:**

**Rule:** FW-101

**Src:** Plant IT

**Dst:** Cell or OT

**Service:** TCP 44818 EtherNet/IP to PLC subnet

**Owner:** Controls engineering

**Last hit:** 2

**Decision:** Tighten

**Rule:** FW-117

**Src:** Vendor VPN

**Dst:** Cell or OT

**Service:** TCP 3389 RDP to jump host

**Owner:** Maintenance lead

**Last hit:** 41

**Decision:** Keep

**Rule:** FW-142

**Src:** Corporate

**Dst:** Plant IT

**Service:** TCP 1433 SQL to ERP database

**Owner:** ERP administrator

**Last hit:** 1

**Decision:** Keep

**Rule:** FW-155

**Src:** Cell or OT

**Dst:** Internet

**Service:** Any any

**Owner:** Unknown

**Last hit:** 260

**Decision:** Remove

**Rule:** FW-160

**Src:** DMZ

**Dst:** Plant IT

**Service:** TCP 443 EDI gateway to ERP

**Owner:** Supply chain IT

**Last hit:** 0

**Decision:** Keep

**Totals:**

#### Stale rules

**Key:** stale

**Agg:** sum

**Format:** integer

#### Rules reviewed

**Key:** rule

**Agg:** count

**Format:** integer

**Summary:**

#### Share of rules stale

**Key:** stale_pct

**Expr:** if(gt(count, 0), sum_stale / count * 100, 0)

**Format:** percent

**Notes:** Hit counts depend on your firewall logging and retention. Confirm counters were not reset before treating a rule as unused. Always test removal in a change window.

## Content

**Intro:** Firewall rulebases grow by accretion: a vendor needs access for a week, a project ends, nobody removes the rule. This worksheet turns a rule export into a review with owners, last use and a decision per rule.

**Sections:**

#### How to use the worksheet

**Body:** Export your rulebase, with hit counts if your platform provides them, and paste the key fields into the worksheet. Assign a business owner to each rule; a rule with no owner is already a finding. The stale flag marks rules unused for more than 180 days. Choose keep, tighten, remove or investigate, then export to Excel and hand the removals to a change request.

#### What to look for

**Body:** Segmentation guidance such as the Purdue model and IEC 62443 zones and conduits expects tightly defined paths between IT and OT. Review any rule with any-any services, broad source ranges into control networks, direct internet access from cell networks, and remote access paths that bypass a jump host.

**Bullets:**

- Overly broad source or destination ranges
- Rules with no owner or no ticket reference
- Disabled rules left in place
- Temporary vendor rules that never expired
- Shadowed rules that never match

#### Handling stale rules safely

**Body:** A zero hit count may mean the rule is truly unused, or that the traffic is rare, such as a quarterly job or disaster recovery path. Ask the owner, check across a full business cycle including month-end and annual events, and disable before deleting. Keep a record of the decision and a rollback copy of the configuration.

#### Common mistakes

**Body:** Reviews fail when they check only syntax and not business need, when hit counters reset after a firewall reboot or upgrade, or when OT staff are not part of the discussion. Schedule the review at least twice a year, and tie each decision to a change record so the audit trail is complete.

**Cta:** Netray can discuss helping you summarize rulebase exports with a private, on-prem model so configuration data never leaves your network.

**Faq:**

#### How often should firewall rules be reviewed?

**Answer:** Common practice is at least every six to twelve months, and after any major project or acquisition. Security frameworks and some customer contracts expect a periodic documented review, so keep the completed worksheet as evidence.

#### What threshold makes a rule stale?

**Answer:** The worksheet uses 180 days with no hits, which is a typical starting point. Adjust it to your business cycle. If you run annual shutdown tasks, check a full year before deleting anything.

#### Who should own a firewall rule?

**Answer:** The business or system owner who needs the traffic, not the network team that implemented it. Owners confirm the need and approve removal. If no one claims a rule, treat it as a candidate for removal after testing.

#### Does this replace a firewall audit tool?

**Answer:** No. Commercial tools analyze large rulebases automatically. This worksheet suits smaller plants and gives structure to the human review and decisions, which tools still require.

## Search terms

firewall rule review template, firewall audit spreadsheet, firewall rulebase review checklist excel, stale firewall rules, OT firewall rule review, network segmentation rule review, firewall change review worksheet, firewall recertification template

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json