Industrial Firewall Configuration
for Pharma OT
What IQ Checks

The Firewall as a Validated Component

The firewall in a pharma OT system is not managed by the IT department as a routine infrastructure device. It is a GAMP Category 1 hardware component in the validated system boundary — its model, firmware version, and configuration are all documented in HDS Section 1.3 and Section 7.3, and any change to the firewall configuration after IQ is a change to a validated system requiring formal change control. This is the same principle that applies to the managed switch, the SCADA server OS, and the PLC firmware.

The IQ-CYB section (cybersecurity installation verification) is Section 9 of the IQ protocol. It covers four areas: network segregation and firewall rule verification (IQ-CYB-001 to 005), default credential changes (IQ-CYB-010 to 014), VPN and remote access (IQ-CYB-015 to 017), and physical security. The firewall rule verification steps — IQ-CYB-002 to IQ-CYB-004 — are the most technically demanding steps in the entire IQ protocol, and they are the ones most likely to produce findings if the HDS was not written with sufficient specificity.

The Complete Rule Set — What HDS Section 7.3 Must Contain

A complete pharma OT firewall rule set follows a defined pattern: specific permit rules for documented conduits, explicit deny rules for the most critical paths, and a default deny-all rule as the last rule. The rules below represent the full rule set from a typical pharma SCADA/PLC system — this is the structure documented in HDS-SYS-001 Section 7.3 in the QLean Framework.

Every rule in this table generates a corresponding IQ verification step. FW-001 and FW-002 are verified by a positive connectivity test (SCADA can reach the PLC on the permitted protocol). FW-005 and FW-006 are verified by a negative connectivity test — a corporate device attempts to reach the OT network and is blocked. FW-009 (the implicit deny) is verified by confirming the firewall policy ends with a deny-all rule and that any traffic not in the permit rules is logged.

The IQ Connectivity Tests — Active Verification

Rule table comparison is necessary but not sufficient. The IQ team must also run active tests that confirm the rules behave as documented. These tests are the IQ-CYB-003 and IQ-CYB-004 steps — they are functional tests performed during the IQ, not the OQ, because they verify the static installed configuration rather than application-layer behaviour.

The Implicit Deny — Why FW-009 Is Not Optional

The last rule in every pharma OT firewall policy must be an explicit deny-all rule. Many firewall platforms have an implicit deny-all that is not visible in the rule base — but from an IQ documentation perspective, an implicit rule that cannot be inspected creates a documentation gap. The IQ verifier must be able to confirm that the default deny exists, and the cleanest way to do this is to have it as a visible, numbered rule in the HDS rule table and in the exported rule base.

Without a documented default deny, a security auditor or inspector cannot be certain that traffic not covered by the permit rules is actually blocked. The argument "the firewall vendor implements implicit deny" is technically correct but does not satisfy the IQ verification requirement. Write it as FW-009, document it in the HDS table, and confirm it in the IQ rule export. The one-line entry in the HDS is worth it for the clarity it provides during every IQ and every subsequent inspection.

Firewall Logging as GMP Evidence

Annex 11 §12 requires that access control events are logged. For a pharma OT firewall, this means the firewall must be configured to log all denied connections and all permitted connections on security-relevant rules (VPN authentication, access to OT zones). The firewall event log is a GMP record — it must be retained, protected from modification, and accessible for inspection.

The IQ must verify the logging configuration is enabled and that log retention meets the GMP record retention requirement. The log must be stored in a location that is backed up and protected. If the firewall forwards logs to a SIEM (Security Information and Event Management) system, the IQ must document the SIEM as a GMP record system for this log data. This connects to the broader IEC 62443 cybersecurity framework requirement for timely response to events (FR-6) — a log that no one reviews is not a security control.

OS Hardening — HDS Section 7.4

The firewall is only part of the security configuration the IQ verifies. HDS Section 7.4 (OS and Software Hardening Baseline) documents the security configuration applied to all Windows-based OT components — SCADA server and HMI workstations. The IQ-SW-020 to IQ-SW-024 steps verify this baseline: Windows Firewall rules (only required application ports open), unnecessary services disabled (Print Spooler, Remote Registry, Bluetooth), USB removable media blocked via Group Policy, autorun disabled, and antivirus/EDR deployed.

Every item in HDS Section 7.4 generates an IQ verification step. The USB block test (IQ-SW-023) is one of the most consistently failed — a USB drive is inserted into the SCADA server and each HMI workstation, and the result must be that access is blocked. A single workstation where USB is not blocked by Group Policy is an IQ nonconformance, even if it was intended to be covered by the same policy as the others. The IQ is device-by-device, not policy-by-assumption.