Is authority for firewall change approval documented? Please list approver names or titles in Additional Info.

Reviewers want documented accountability for firewall changes, including a formal approval process and a clear record of who holds the authority to approve them.

Firewalls are critical security controls that regulate network traffic between different network segments (like between the internet and your internal network). Changes to firewall rules can significantly impact your security posture - opening incorrect ports or allowing traffic from unauthorized sources could create security vulnerabilities.

The question is being asked in a security assessment because:

1. Change management for critical security infrastructure is a fundamental security practice
2. Proper authorization ensures that firewall changes are necessary and properly vetted
3. Documentation of approval authority creates accountability and an audit trail
4. It helps prevent unauthorized or ad-hoc changes that could weaken security

To best answer this question:

1. Confirm whether you have a documented process for firewall change approvals
2. Identify the specific roles or individuals who have authority to approve firewall changes
3. Be prepared to provide evidence of this documentation if requested
4. In the 'Additional Info' section, list the names or titles of those with approval authority

Even if you outsource firewall management to a third party, you should still have internal approval processes for requesting changes to your provider.