What your audit scramble reveals about network policy governance

Your audit has been booked, and now the scramble begins. Across all your systems, you need to pull together one coherent story of who changed what, when, and why, mapping firewall changes to the business reasons that once justified them.

 

For as long as this process is ongoing, security teams find themselves pulled away from security work and into forensic administration: chasing change tickets, filling gaps and reconstructing events from months ago. And then, once the mad scramble is over, the business goes back to normal, and the frustrations are forgotten… until the next audit starts the cycle again.

 

We have come to treat that scramble as an unavoidable cost of doing business. But what if that needlessly stressful process is also a warning sign? The effort required to reconstruct decisions at audit time can reveal gaps in how security policy is governed, understood and evidenced throughout the year.

 

The story you’re expected to tell

Auditors expect you to tell a security story which is not only true but easy to follow. The expectation is that this simple narrative will already be at hand when audit time comes round, but in many cases, business leaders find themselves scrabbling among a flurry of loose pages, trying to piece it all together after the fact.

 

But if explaining your policy environment requires substantial reconstruction at audit time, that should raise a governance question: how readily can the organisation understand what its environment permits, and why, during the rest of the year? The scramble does not prove that controls are ineffective, but it can expose gaps in ownership, visibility and traceability that periodic audit preparation alone will not address.

 

AI is also widening the gap between how quickly a security environment can change and how quickly an organisation can reconstruct what happened. Vulnerabilities can be identified faster, security changes can be developed and deployed more quickly, and organisations increasingly need continuous governance of the policies that define access, firewall rules, microsegmentation, security change and compliance across hybrid environments.

 

What the evidence can - and can’t - prove

There is a difference between having evidence and being able to find it. In its March 2026 review of firms’ operational-resilience self-assessments, the FCA highlighted a related problem. Where some firms reported few or no outstanding vulnerabilities, the regulator found that a lack of information or evidence around mapping, testing and vulnerability management made it difficult to establish whether vulnerabilities had been properly identified.

 

From a governance perspective, this goes to show that an assertion about the state of a control is much harder to rely on when the evidence needed to substantiate it is incomplete or difficult to trace. After all, a clean-looking account proves that you can produce a clean-looking account; it does not, by itself, prove that the underlying policy environment was well governed throughout the year. Evidence matters because it allows effective controls and governance processes to be demonstrated. By itself, it’s not a substitute for those controls.

 

This is why compliance should not be reduced to a documentation exercise. It depends on effective controls, supported by evidence showing how decisions were made and whether those controls operated as intended. That evidence should be captured at source, as part of governing changes when they are made, rather than reconstructed once a year for audit.

 

The governance problem hidden in your documentation

Consider what an auditor really wants to know about any single firewall or segmentation change: Who requested it? Was the risk assessed before it went live? Was it implemented as intended? Does it still align with policy today? Those questions are straightforward to answer when the change happens. Several months later, however, answering them may require reconstructing an entire chain of decisions.

 

The natural objection is that mature organisations already capture these answers as they go. But a repository of change tickets, reconstructed into a coherent narrative once a year, is not the same as knowing in real time what your estate permits. Nor are configuration and effective access the same thing: what a rule was written to do and what it actually allows, once it interacts with every other rule across the estate, can diverge without anyone noticing.

 

Our own data proves it. Across 9.2 million anonymised policy checks, FireMon found that 45% of firewall rules lacked an owner or documentation. The majority (69%) of rules were unused, having been left behind by years of temporary exceptions nobody felt empowered enough to remove. This is not a filing problem to be solved with tidier documentation. Instead, it could be an indication of a deeper governance problem, if only you could see it beneath all that paperwork.

 

Compliance as a mode of governance

Periodic assessments remain an important part of compliance, but they increasingly sit alongside requirements for ongoing risk management, monitoring, testing and review.

 

DORA has applied to in-scope financial entities since 17th January 2025. Among other requirements, it requires firms to maintain an ICT risk-management framework, continuously monitor the security and functioning of systems and identify sources of risk on an ongoing basis. ICT risk-management frameworks must also be reviewed at least annually for most financial entities, and controls and resilience measures must be tested regularly.

 

In the UK, the Cyber Security and Resilience Bill is intended to strengthen the existing NIS framework, put the NCSC’s Cyber Assessment Framework on a firmer footing, and bring the regime closer to NIS2. But the Bill has attracted criticism in the House of Lords over its limited treatment of AI, with peers questioning whether the legislation adequately reflects the fast-changing technology and threat landscape.

 

The broader point here is not that periodic assessment is disappearing. It is that organisations increasingly need to demonstrate how risk is identified, managed, monitored and reviewed between those formal assessment points. That makes the quality and accessibility of the underlying evidence increasingly important.

 

Keeping the thread

Go back to that idea of your security posture as a story. If asked, you should be able to say, with confidence: this is what we permit (and why), and this is what’s changed (and why). The organisations with the smoothest audits are not the ones that can piece together the pages of that story under pressure. Instead, they’re the ones that never lost the thread, so they know what story they’ll tell before being asked.

 

This is why organisations should treat policy as a single, continuously governed control plane, rather than a collection of devices reconciled once a year for compliance purposes. At FireMon, we found that automated, validated change workflows carried 67% less change-related risk than manual ones, because each change is checked against everything already in place before it goes live, not after.

 

Get this right, and you’ll find that you’re ready for an audit before you even know it’s coming. And audits aside, continual monitoring brings benefits throughout the business. It means stronger governance, lower operational overhead, and greater confidence that security policies remain aligned with business intent as environments evolve.

 

In the AI age, that’s what true, year-round compliance looks like.  

 

---

 

David Brown is SVP International Business at FireMon

 

Main image courtesy of iStockPhoto.com and imaginima