A. Administrative access to respond to requests to change the firewall is limited to one individual at a time

B. Active network connections are tracked so that invalid response' traffic can be identified.

C. A current baseline of application configurations is maintained and any mis-configuration is responded to promptly

D. Logs of user activity on the firewall are correlated to identify and respond to suspicious behavior