Questions this engagement should answer
- Which rules have a clear business purpose, owner and review date?
- Where do broad services, sources, destinations or administrative paths create avoidable exposure?
- Which rules appear unused, duplicated or shadowed and what evidence is needed before change?
- Can proposed remediation be staged, monitored, validated and rolled back?
What the work includes
- Scope confirmation and read-only evidence planning
- Review of agreed policy, objects, zones, logging and available usage evidence
- Working review of material findings and uncertain assumptions
- Prioritized candidate actions with dependencies, validation and rollback considerations
Deliverables
- Observed-policy findings with evidence references
- Ownership and recertification action register
- Prioritized remediation candidates
- Change-safeguard and validation notes for approved follow-on work