--- title: "Does the Applicant employ external/perimeter and internal firewalls?" url: https://insuranceposture.com/questions/network-and-logging/applicant-employ-external-perimeter-internal-firewalls category: "Network, logging and monitoring" canonical_key: q_net_001 evidence_state: partial updated: 2026-08-24 --- # Does the Applicant employ external/perimeter and internal firewalls? URL: https://insuranceposture.com/questions/network-and-logging/applicant-employ-external-perimeter-internal-firewalls Section: Network, logging and monitoring Evidence state: Partly verifiable from your tenant Everyone has a perimeter firewall. The word that carries the question is internal, because that is what constrains an attacker who is already inside. ## What the carrier is actually asking The carrier is asking about filtering at the boundary and between internal zones. A perimeter device protects against the outside; internal filtering limits what a compromised workstation can reach. The second is what changes the outcome of an intrusion that has already begun. ## Why it is underwritten Initial access is a matter of when. What determines the size of the loss is how far the attacker travels afterwards. Internal filtering is the control that makes lateral movement slow, noisy, or impossible, and carriers weight it accordingly. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Cloud network controls are directly measurable. On-premises firewalls are attested and should be supported by a configuration export. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Azure | Network security groups and their default rules | Deny by default with explicit allow rules, rather than permissive rules inherited from a template | | Azure | Azure Firewall or network virtual appliance at the boundary | A filtering point for egress as well as ingress, since command and control traffic leaves rather than arrives | | Azure | Public network access settings on storage, databases, and key vaults | Public access disabled with private endpoints, which is the cloud equivalent of not exposing internal services | | Azure | Subnet design and network security group assignment | Workloads separated into subnets with filtering between them, not a single flat virtual network | | On-premises | Perimeter and internal firewall configuration and rule base | Rule base with deny-by-default, reviewed. Attested | **Egress filtering is the underrated half** Most firewall answers describe inbound control. Outbound filtering is what interrupts command and control and data exfiltration, and it is absent or fully permissive in a large share of environments. Mentioning it distinguishes your answer. ## What a defensible yes requires - Filtering exists at the boundary and between internal zones. - Default posture is deny, with allow rules that have owners and justifications. - Outbound traffic is filtered, not only inbound. - Cloud services are reachable through private endpoints rather than public addresses. - Rule bases are reviewed, since accumulated rules are how a deny-by-default posture becomes permissive. ## How this answer goes wrong A capable perimeter firewall protects a completely flat internal network, so any compromised device can reach every server. Or cloud workloads sit behind a network security group whose rules were copied from a template and allow far more than the workload needs. ## If this answer turns out to be wrong Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Do cloud network security groups count as firewalls? Yes, for this question. They are the filtering layer in a cloud estate and they are directly measurable, which makes the answer evidenced rather than asserted. ### What if we are fully cloud with no offices? Answer for the cloud estate and say the perimeter is identity rather than network. That is a coherent modern answer when Conditional Access carries the weight. ### How often should rules be reviewed? Annually at minimum. A separate question asks about this directly, so the two answers should agree. ### Is a next-generation firewall expected? Not required. Capability matters more than product category, and internal segmentation matters more than either. ## Related questions - [Has the Applicant applied network segmentation within its environment?](https://insuranceposture.com/questions/network-and-logging/applicant-applied-network-segmentation-within-environment) - [What is the firewall policy: deny all by default, permit by exception?](https://insuranceposture.com/questions/network-and-logging/firewall-policy-deny-by-default-permit-by-exception) - [Is inbound and outbound traffic to critical servers restricted using an allow-list approach?](https://insuranceposture.com/questions/network-and-logging/inbound-outbound-traffic-critical-servers-restricted-using-allow-list) - [How frequently is firewall configuration reviewed and firmware updated?](https://insuranceposture.com/questions/network-and-logging/frequently-firewall-configuration-reviewed-firmware-updated) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.