soc2-ngfw-compliance

Map firewall rules to SOC 2 criteria by building a firewall-to-control matrix that links each rule's owner, purpose, and logging to control IDs and criteria like CC6, CC7, and CC8. The Skill's control-mapping reference provides a starting table for logical access, system operations, and change management.

SOC 2 Type II firewall evidence includes sampled change tickets with approvals and validation, rule review records, admin and VPN access reviews, SIEM log forwarding and alert triage records, and incident tickets spanning the full examination period. Point-in-time screenshots alone are insufficient.

No, a firewall is not SOC 2 compliant by itself. SOC 2 reports cover an organization's system controls, criteria, and examination period; the firewall only supports those controls when configured, monitored, reviewed, and evidenced consistently.

Yes, parse raw configurations first with the matching vendor parsing skill for Cisco, Fortinet, Palo Alto, or Juniper before mapping findings to SOC 2 criteria. This Skill operates on parsed config data, not raw device output.

Type I assesses control design at a single point in time, while Type II requires evidence that controls operated effectively across the full report period. For firewalls, Type II demands sampled changes, reviews, and logs from throughout the period.