Technical tools manage firewall rule sets and alert on changes or rules that conflict with security policy
A firewall with change logging and alerts on rule modifications monitors network boundary behavior, flagging rule edits that could open an unauthorized access path.
An edge firewall denying inbound traffic by default with logged, alerted changes is one perimeter mechanism inside A.8.20, which also requires securing and managing controls between internal zones.