Reviewed and corrected October 30, 2026. The original publication date is retained.
A firewall can help control network traffic using defined rules. Whether it is an appropriate control, where it belongs, and how it should operate depend on the organization’s architecture, exposures, and commitments.
SOC 2 is an attestation reporting framework, not a regulation that prescribes a firewall at every external connection. In SOC 1, a network control matters where it supports relevant financial-reporting control objectives. See the AICPA SOC resources for the distinction between report types.
What Would a Useful Control Describe?
Sample Control: The network owner approves changes to relevant firewall rules, retains the reason for the change, and reviews the configuration at an interval defined by the organization. Identified inappropriate rules are tracked through correction.
This is an example to adapt, not a required SOC control statement. Cloud security groups, managed services, and other architectural safeguards may also be relevant to the actual environment.
What Evidence Helps Explain the Work?
- The in-scope network connections and the people responsible for them.
- Requests and approvals for rule changes, with the resulting configuration.
- Review records showing what was checked, what was found, and who decided what to change.
- Records showing identified issues were corrected and the result verified.
Example Scenario: A temporary rule is approved for a migration. The request records its purpose and expected removal date. After the migration, the owner verifies removal and retains that evidence rather than assuming the original approval closed the task.
Keep the Claim Within the Control
A firewall helps manage some network risks; it does not establish that all access is appropriate or prevent every incident. Review it alongside identity permissions, system changes, monitoring, and the other controls relevant to the service.
Our access-control examples address another part of that discussion.