> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alignr.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Networks and firewalls

> Firmware availability, network inventory and configuration recovery.

This category contains **1 automated control definitions** and **3 manual checks** across the sources named below. Similar controls from different standards are listed separately because names, thresholds or severity can differ.

Whether the seeded Alignr Baseline is available depends on how your workspace was provisioned. Library templates are copied as disabled drafts. See [Choose a baseline](/controls/baselines/overview) before enabling anything.

## Automated controls

Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.

<AccordionGroup>
  <Accordion title="Network firmware has no update pending">
    <Tabs sync={false}>
      <Tab title="Explanation">
        Each selected device should report that no firmware update is available.

        Part of **BIOS Network Health**.

        **Applies to**

        Subjects with a recorded firmware update available observation.

        **What the result tells you**

        No reported update is not proof of supported firmware or full device hardening. An available update still needs risk review and scheduling.
      </Tab>

      <Tab title="Definition">
        | Setting           | Value               |
        | ----------------- | ------------------- |
        | Standard          | BIOS Network Health |
        | Severity          | Medium              |
        | Declared autonomy | Suggest only        |

        **Population condition**

        **Firmware update available** (`firmware_update_available`) has an observation.

        **Expected evidence**

        * **Firmware update available** (`firmware_update_available`) equals `false`.

        **Required predicates:** `firmware_update_available`.

        ```json theme={null}
        {
          "match": {
            "predicate": "firmware_update_available"
          },
          "expect": [
            {
              "fact": "firmware_update_available",
              "op": "eq",
              "value": false
            }
          ],
          "severity": "medium",
          "title": "Network firmware update is available",
          "evidence": [
            "firmware_update_available"
          ]
        }
        ```
      </Tab>
    </Tabs>
  </Accordion>
</AccordionGroup>

## Manual checks

These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.

<AccordionGroup>
  <Accordion title="Review network device availability">
    **Review every 30 days** · BIOS Network Health

    Check the firewall, switches and access points against the approved network inventory. Record missing or offline devices and confirm the source population excludes endpoints and unrelated resources.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>

  <Accordion title="Review firewall security baseline">
    **Review every 30 days** · BIOS Network Health

    Review rules, management exposure, logging, subscriptions and approved exceptions. Current connector facts do not prove the full configuration baseline.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>

  <Accordion title="Test network configuration recovery">
    **Review every 90 days** · BIOS Network Health

    Confirm a current configuration backup exists and perform the documented recovery validation. Firmware inventory does not prove backup recoverability.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>
</AccordionGroup>

## Investigate a result

Confirm the client and the account, device or other item being assessed. Check the source, observation time and effective settings, then compare the recorded evidence with the expectation. Missing evidence needs investigation; a change to the environment requires a separate review.

## Next steps

[Create a custom control](/controls/create-custom) · [Parameters and client overrides](/controls/parameters) · [Record a manual check](/controls/manual-checks)