Verify that adequate reports and logging procedures detailing hardware and software failures and repairs are kept and if the reports are reviewed by management. Verify that maintenance agreements and software licensing agreements are maintained. Determine that unrelated equipment and supplies are not stored in the secure area. Verify that the area where the firewall equipment is maintained is equipped with temperature controls, fire detection devices, extinguishers, and UPS backup. Determine if security procedures prevent unauthorized removal of equipment from premises.
Management first needs to identify all entry points.
Dial in modems can be extremely vulnerable if not protected by the firewall. Review recent scan reports. Determine if security logs can be exported to another machine ie. Review all security reports. Interview management to determine who reviews the security reports internally, how often they are reviewed, and how long the reports are maintained.