Title

The site will establish a configuration baseline and policy regarding the use and configuration of personal firewalls for remote access clients. (Cat III impact)

Discussion

A firewall configuration baseline will allow the IAO to have a mechanism to check the compliance of a firewall with the site policy. These configurations can sometimes be updated by users and should be compared to a baseline.

Check Content

Review a copy of the site’s baseline procedures or written policy regarding configuration of remote access devices. Note that this check does not include validation of the contents, which is verified in another requirement. If a personal firewall baseline configuration document does not exist, this is a finding.

Fix Text

Develop a software baseline for the personal firewall configuration.

Additional Identifiers

Rule ID: SV-6801r1_rule

Vulnerability ID: V-6655

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.