Requirement to review firewall and router rule sets at least every six months