Which of the following is true about firewall documentation and awareness?

• A. Security policies and operational procedures for managing firewalls are documented, in use, and known to all affected parties.
• B. Policies are optional and need not be communicated.
• C. Only IT staff need to know them.
• D. Documentation is not required.

Answer: (A)

The main idea here is that firewall governance hinges on having security policies and operational procedures that are documented, actually used, and known by everyone who is affected. When the rules for how the firewall is configured, who can approve changes, how changes are tested, and how incidents are handled are written down and communicated, there’s a clear, shared standard everyone follows. This ensures consistency, accountability, and traceability, which helps prevent ad hoc or conflicting configurations and supports auditability. Awareness means that not just IT staff, but all relevant personnel—including owners of the systems and operations teams—understand their roles and the implications of the firewall policies, so changes are made in a controlled and predictable way. If policies are treated as optional, or only kept by a few people, or if documentation isn’t required, it opens the door to misconfigurations, gaps in security, and difficulties proving compliance.