“Temporary supplier access” is a poor explanation for a firewall rule that's been there for two years. Before keeping it, find out which current job needs the opening and whether the rule still matches that job.
A useful review ends with a decision for each incoming opening: keep it with a confirmed reason, remove it safely, or investigate a specific unknown. A list of rules marked “reviewed” doesn't tell you what was decided.
IASME's firewall guidance says incoming openings need a legitimate business reason, must be documented and must be turned off when no longer needed. The review method below is practical preparation, not an additional scheme requirement.
Start with the rule's job
Have the authorised administrator explain what each opening lets someone reach. A rule name, port number or product logo alone isn't enough.
For each rule, answer four questions:
- What current business task requires it?
- Which service and device receive the connection?
- Who or what is allowed to connect, and how is access protected?
- What would stop working if this opening were removed?
Use those answers to choose the next step. Keep a rule when the need and settings are confirmed. Plan removal when the job has ended and dependencies have been checked. Investigate when nobody can establish its purpose, destination or protection.
“Nobody remembers” belongs in the third group. It is neither a sound reason to keep the opening indefinitely nor a safe instruction to delete it immediately.
Work through an old supplier rule
Imagine a fictional warehouse with a rule created during a stock-system upgrade. Its register says “vendor support”, but the vendor now uses a different approved support method.
The warehouse checks whether any current process still uses the old connection. It includes occasional jobs, such as year-end maintenance, rather than relying only on an ordinary morning's activity. Quiet logs can help an investigation, but they don't establish that a rarely used route is unnecessary.
Once the dependency check supports removal, the administrator schedules the change with a way to restore service if needed. Afterwards, the warehouse checks a test order and the agreed current support route.
Its completion note could read:
Old stock-system support opening removed on 12 June. Vendor confirmed that current support uses the separate agreed route. Test order completed and current support connection checked. Configuration record saved in the restricted IT folder.
That note explains both the decision and its checked result. “Supplier rule tidied up” doesn't.
Look separately at administration
An opening for a customer-facing service and remote access to the firewall's own settings are different questions. Don't let a valid reason for the first serve as an answer about the second.
The current NCSC requirements address protection of firewall administration from the internet. Ask the administrator to check that route explicitly, including the authentication and access restrictions actually applied.
On laptops, check where the rule applies too. Microsoft explains that Windows Firewall rules can depend on the network profile. A rule intended for the office needs checking against how the laptop is used elsewhere.
Leave the review with no unexplained “keep” decisions. Where investigation is still open, write the missing fact and arrange to obtain it. If you need help interpreting the questionnaire itself, our plain-English firewall questions cover that separate task.