Report on the percentage of workstation firewalls, host firewalls, sub-network firewalls, and perimeter firewalls configured in accordance with policy.

UCF ID: 02116

Control Type: Actionable Reports or measurements

Status: Live

Metric guidance

Calculation: The calculation for this metric is # of workstation firewalls, host firewalls, sub network firewalls, and perimeter firewalls configured in accordance with policy / # of installed firewalls.

Calculation source: No authority document source of information exists. The following formula was used: the number of firewalls that have been configured according to the policies, standards, and procedures divided by the number of installed firewalls listed in the hardware inventory for each business unit (or the organization as a whole) .

The Common Control IDs associated with this metric are as follows:

Install and configure application layer firewalls for all key web-facing applications. [UCF Control ID 01450]

Establish and maintain a standard and procedure for firewall design and configuration practices. [UCF Control ID 00544]

Install firewalls on all mobile computers, correctly configure all firewalls, and prevent the firewalls from being disabled or changed by end users. [UCF Control ID 00550]

Configure firewalls, routers, and networking equipment to protect restricted data or information in accordance with organizational compliance mandates. [UCF Control ID 01284]

Supporting and supported controls

This control directly supports:

Establish and maintain a networks and firewalls management metrics program. [UCF Control ID 02082]

There are no supporting controls.

Authority documents complied with:

CISWG Information Security Program Elements, January 10,2005, ISPE26.1; Guide for Developing Performance Metrics for Information Security, NIST SP 800-80, Table 20

US Federal Security Guidance

The organization must measure and report on the percentage of workstation firewalls, host firewalls, subnetwork firewalls, and perimeter firewalls configured in accordance with policy. [ISPE26.1, CISWG Information Security Program Elements, January 10,2005]

NIST Guidance

This metric must be calculated using # of workstation firewalls, host firewalls, sub network firewalls, and perimeter firewalls configured in accordance with policy / # of installed firewalls [Table 20, Guide for Developing Performance Metrics for Information Security, NIST SP 800-80]