CIS · Control 4.4 · Priority: critical · Component: Protect

What this control covers

Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.

Why it matters

A defended network limits blast radius after an initial compromise — the difference between an incident and a breach is often the controls described here.

How to implement

AWS

Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.

Azure

Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.

GCP

Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.

Evidence to collect

  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.
  • vendor_risk_management — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Focus: Implement and Manage a Firewall on Servers.

Quick checklist

  • Implement And Manage — Network / Servers
  • Protect — Network / Servers

Related articles on this site