Compliance & ContractsFree worksheetPDF, Excel, Word exportDiscrete Manufacturing

Plant Firewall Rule Review Worksheet

Firewall rulebases grow by accretion: a vendor needs access for a week, a project ends, nobody removes the rule. This worksheet turns a rule export into a review with owners, last use and a decision per rule.

Download:

Rule ID	Source zone	Destination zone	Service or port	Business owner	Days since last hit	Stale flag	Decision
						0
						0
						0
						1
						0

Stale rules

Rules reviewed

Share of rules stale

20%

Hit counts depend on your firewall logging and retention. Confirm counters were not reset before treating a rule as unused. Always test removal in a change window.

Private AI review of your configuration exports

Optional: ask how an on-prem model could summarize rulebases without sending data outside.

Optional. The tool and every export work without this. No spam.

How to use the worksheet

Export your rulebase, with hit counts if your platform provides them, and paste the key fields into the worksheet. Assign a business owner to each rule; a rule with no owner is already a finding. The stale flag marks rules unused for more than 180 days. Choose keep, tighten, remove or investigate, then export to Excel and hand the removals to a change request.

What to look for

Segmentation guidance such as the Purdue model and IEC 62443 zones and conduits expects tightly defined paths between IT and OT. Review any rule with any-any services, broad source ranges into control networks, direct internet access from cell networks, and remote access paths that bypass a jump host.

Overly broad source or destination ranges
Rules with no owner or no ticket reference
Disabled rules left in place
Temporary vendor rules that never expired
Shadowed rules that never match

Handling stale rules safely

A zero hit count may mean the rule is truly unused, or that the traffic is rare, such as a quarterly job or disaster recovery path. Ask the owner, check across a full business cycle including month-end and annual events, and disable before deleting. Keep a record of the decision and a rollback copy of the configuration.

Common mistakes

Reviews fail when they check only syntax and not business need, when hit counters reset after a firewall reboot or upgrade, or when OT staff are not part of the discussion. Schedule the review at least twice a year, and tie each decision to a change record so the audit trail is complete.

Frequently Asked Questions

How often should firewall rules be reviewed?

Common practice is at least every six to twelve months, and after any major project or acquisition. Security frameworks and some customer contracts expect a periodic documented review, so keep the completed worksheet as evidence.

What threshold makes a rule stale?

The worksheet uses 180 days with no hits, which is a typical starting point. Adjust it to your business cycle. If you run annual shutdown tasks, check a full year before deleting anything.

Who should own a firewall rule?

The business or system owner who needs the traffic, not the network team that implemented it. Owners confirm the need and approve removal. If no one claims a rule, treat it as a candidate for removal after testing.

Does this replace a firewall audit tool?

No. Commercial tools analyze large rulebases automatically. This worksheet suits smaller plants and gives structure to the human review and decisions, which tools still require.

Netray can discuss helping you summarize rulebase exports with a private, on-prem model so configuration data never leaves your network.

Talk to an Expert Explore More Free Tools

Related Tools

ERP Operations

More Compliance & Contracts tools

See all

Back to All Tools