Beyond Policy Optimization: Cisco Secure Firewall Adds a Compliance Check

Firewall policies rarely get simpler over time.

New applications are introduced, old applications are retired, temporary rules become permanent, objects are reused, and troubleshooting changes sometimes remain long after the original problem has been resolved. Over time, even a well-designed firewall policy can accumulate unnecessary complexity.

Cisco has been addressing this problem with Policy Analyzer and Optimizer in Security Cloud Control. The feature analyzes Access Control Policies and identifies conditions such as duplicate and redundant rules, shadowed rules, expired rules, overlapping objects, and rules that may be candidates for consolidation. Cisco has also extended the capability to NAT policies, where it can identify fully shadowed and redundant NAT rules.

This type of analysis addresses what could be described as policy debt.

A firewall policy can continue to enforce traffic correctly while becoming increasingly difficult to understand and maintain. A fully shadowed rule, for example, never evaluates traffic because another rule above it already matches that traffic. An overlapping object can add complexity without changing what a rule actually matches.

Policy Analyzer and Optimizer helps administrators identify these conditions and, for supported Access Control Policy findings, stage remediation directly from the analysis. Supported actions include disabling or deleting duplicate and expired rules, removing fully overlapped objects, and merging rules identified as mergeable. NAT analysis currently focuses on identifying shadowed and redundant rules rather than providing the same remediation workflow.

The result can be a firewall policy that is easier to understand, maintain, and troubleshoot.

But policy optimization only answers part of the question.

A firewall policy can contain no duplicate rules, no expired rules, and no obvious shadowing and still allow traffic that conflicts with the security controls an organization is expected to maintain.

A clean policy is not necessarily a compliant policy.

From Policy Health to Compliance Posture

On September 17, 2026, Cisco added Compliance Posture to AgenticOps in Security Cloud Control. The first supported compliance template evaluates Secure Firewall configurations against PCI DSS 4.0.1 requirements.

Policy Analyzer and Optimizer asks questions such as:

Compliance Posture asks a different type of question:

Does the firewall configuration support the controls the organization is expected to maintain?

The current PCI DSS 4.0.1 template evaluates firewall configurations across four areas: network security, access control, secure configuration, and logging. 

Cisco describes the capability as translating higher-level compliance guidance into programmatic checks that can be applied against firewall configurations.

This moves the analysis beyond identifying configuration inefficiencies and begins connecting firewall policy to a defined security and compliance objective.

A Simple Example

Consider an Internet-facing application that processes payment information.

An Access Control Policy might contain the following rule:

From a policy optimization perspective, there may be nothing structurally wrong with the rule. It may not be duplicated, shadowed, expired, or contain overlapping objects, and it may be actively receiving traffic.

Policy Analyzer and Optimizer therefore may have no policy-hygiene reason to recommend changing it.

The compliance question is different.

If the systems behind that rule are part of the Cardholder Data Environment (CDE), unrestricted inbound access may require review even though the rule itself is technically valid.

Cisco specifically lists restricting inbound traffic to the CDE as an example of a compliance check that can appear in a Compliance Posture report.

The distinction becomes straightforward:

Policy Analyzer and Optimizer: Is this rule structurally healthy within the policy?

Compliance Posture: Does this access align with the compliance requirement being evaluated?

Those are different questions, and both are useful.

From Periodic Review to Ongoing Validation

Compliance reviews traditionally require someone to understand the requirement, determine which firewall configurations are relevant, identify the systems and security zones that fall within scope, review those configurations, and document the results.

The difficulty is that the firewall environment continues changing after the review is finished.

A temporary troubleshooting rule may be added. An application may move. A new service might be exposed. A security zone may take on a different role.

Compliance Posture provides a repeatable way to reevaluate the firewall after those changes.

For PCI DSS 4.0.1, the process starts by selecting a firewall and reviewing the security zones that should be considered part of the Cardholder Data Environment. Cisco performs an automated assessment to identify zones that are likely to belong to the CDE, but the administrator must review those selections based on their knowledge of the environment.

Cisco specifically warns that incorrect CDE zone selections can result in inaccurate compliance findings, particularly for checks involving segmentation and traffic between network zones.

Once the scope is established, Compliance Posture analyzes the firewall against the PCI DSS 4.0.1 template. The resulting report includes a compliance score and identifies checks that passed, need review, or failed. Individual checks can include a description, references to the applicable compliance standard, identified findings, and remediation recommendations.

Reports can also be exported in JSON format for offline review or audit workflows.

One current limitation is worth calling out. Compliance reports are manually generated and are not automatically evaluated on a recurring schedule. After remediation or configuration changes, the administrator reruns the report to evaluate the updated configuration.

Using Policy Optimization and Compliance Posture Together

These capabilities address different parts of firewall policy management.

Policy Analyzer and Optimizer focuses on the condition of the rulebase itself: duplicate rules, expired rules, shadowing, overlapping objects, and opportunities for consolidation.

Compliance Posture evaluates that configuration against a defined compliance objective.

Neither capability replaces the other.

An optimized policy can still contain access that does not align with the organization's compliance requirements. At the same time, trying to evaluate compliance against a poorly understood and unnecessarily complex rulebase makes review and remediation more difficult.

A practical approach would be to first use Policy Analyzer and Optimizer to reduce unnecessary policy complexity, then use Compliance Posture to evaluate how that policy aligns with the PCI DSS 4.0.1 requirements relevant to the environment.

Where Compliance Posture Stands Today

Compliance Posture is a new capability, and its initial implementation is focused specifically on PCI DSS 4.0.1.

Cisco's current documentation states that the feature evaluates network security, access control, secure configuration, and logging requirements and supports zone-aware analysis based on the CDE defined during report generation.

The feature currently requires Cloud-Delivered Firewall Management Center, AgenticOps, and Firewall Threat Defense devices onboarded and managed through Security Cloud Control Firewall Management. The device being evaluated must also be online and reachable.

As of the current release, Cisco lists Compliance Posture availability in the US, EU, and AUS regions.

Cisco has not publicly documented the complete library of programmatic checks or a requirement-by-requirement mapping showing exactly how every PCI DSS 4.0.1 requirement is translated into Secure Firewall configuration tests. Because of that, Compliance Posture should be treated as an additional validation mechanism rather than proof that every PCI requirement has been satisfied.

Cisco makes that distinction as well. Compliance Posture reports are informational, AI-generated, and do not replace a formal compliance audit performed by a qualified security assessor.

Bringing the Two Together

For organizations already using Security Cloud Control and Cloud-Delivered Firewall Management Center, the value of Compliance Posture is not simply another score on a dashboard.

It adds another stage to the automated continuous firewall policy lifecycle management.

Optimize → Evaluate → Remediate → Change → Reevaluate

Policy Analyzer and Optimizer helps reduce the technical debt inside the rulebase.

Compliance Posture then evaluates that configuration against a defined compliance objective.

The combination changes the conversation from simply asking whether a firewall rule is valid or whether a policy is clean.

It adds another question:

Does this firewall policy still support the controls the organization expects it to enforce?

That is a useful next step in how firewall policy can be reviewed and maintained.   I would expect that we should see new compliance reports coming for other standards