Flat per firewall
£179/month per firewall (£149 from your sixth), plus the VM you run it on. No per-GB data-processing charge — the bill stops scaling with traffic.
NIST · Compliance
NIST firewall rules — boundary controls, checked on every change.
NIST SP 800-53 puts clear obligations on your firewall: boundary protection, deny-by-default, controlled information flow and configuration change control. Enforza ships bundled NIST 800-53 r5 and CSF 2.0 packs and checks each policy change against them, advising or blocking a rule that would break a control before it reaches a firewall.
Enforza helps you implement and evidence the 800-53 control families your firewall rules own. NIST 800-53 and the CSF are control catalogues, not a certification — the broader baseline across your systems is your programme's responsibility.
Which NIST controls your firewall rules implement
Several 800-53 controls land directly on the firewall. Here is what they ask, and the Enforza control that lines up with each.
- SC-7
Boundary protection
Monitor and control communications at the external boundary and key internal boundaries. Enforza policies default-deny on inbound, east-west and outbound, with explicit allows scoped by network, port and hostname — a direct implementation of managed boundary controls.
- SC-7(5)
Deny by default, allow by exception
Network traffic must be denied by default and allowed by exception. Every Enforza section defaults to drop, and a guardrail flags any rule that re-introduces a broad, unscoped allow — so the deny-by-default posture is enforced, not assumed.
- AC-4 / AC-6
Information flow & least privilege
Control the flow of information between connected systems and grant least privilege. Broad egress to 0.0.0.0/0 is scoped with an L7 (FQDN / SNI) matcher rather than a bare-port passthrough, so a guardrail can require each flow to be narrowed to what is needed.
- CM-7
Least functionality
Configure systems to provide only essential capabilities; restrict insecure services. A guardrail flags allow rules for insecure legacy protocols and unnecessary services, catching them before the policy ships.
- CM-3
Configuration change control
Changes to the system must be subject to configuration change control. Run Enforza as policy-as-code or in the console — either way every rule change is checked against the attached NIST pack and recorded as an audit event for your change record.
Control references are to NIST SP 800-53 Rev. 5. Enforza maps to the SC, AC and CM controls a firewall implements; controls outside a firewall's scope are catalogued accordingly. NIST CSF 2.0 ships as a separate bundled pack.
Attach the pack. Advise, then enforce. Evidence everything.
NIST 800-53 r5 and CSF 2.0 are two of 25 bundled framework packs covering 210 firewall-applicable controls. Attach the one you are measured against and every change is checked.
-
Attach the NIST 800-53 or CSF pack
NIST SP 800-53 r5 and NIST CSF 2.0 both ship as bundled framework packs — two of the 25 packs covering 210 firewall-applicable controls. Attach the pack you are measured against, whole or cherry-picked.
-
Advise while you tighten, enforce when ready
Run the pack in advise mode to surface violations without blocking, bring your rules into line, then switch to enforce so a rule that breaks a control is rejected before any firewall sees it.
-
Evidence every check
Every check, advise warning and enforce block is recorded — direct evidence for the SC, AC and CM control families when an assessor reviews your boundary-protection and change-control implementation.
NIST-aligned, without the cloud-firewall tax
A NIST-scoped network usually means a managed firewall plus a NAT gateway — two per-hour fees (often duplicated per Availability Zone) plus two per-GB meters. Enforza is one flat-priced appliance.
Typically 60–80% less
Against a cloud-native firewall stacked with a NAT gateway at modest egress, the flat line is usually 60–80% cheaper — and the gap widens as traffic grows.
No add-on for compliance
The NIST packs and advise-or-enforce guardrails are part of the platform. There is no separate compliance SKU and no per-control charge.
NIST firewall rules — common questions
What does NIST say about firewall rules?
NIST SP 800-53 (the federal control catalogue) expects boundary protection that monitors and controls communications at network boundaries (SC-7), denies traffic by default and allows by exception (SC-7(5)), controls information flow between systems (AC-4), grants least privilege (AC-6), restricts systems to essential capabilities (CM-7), and subjects changes to configuration change control (CM-3). NIST SP 800-41 also gives specific firewall-policy guidance. Enforza's default-deny policies with scoped allows implement those controls, and its guardrails check them on every change.
Does Enforza make me NIST compliant?
NIST SP 800-53 and the Cybersecurity Framework are control catalogues and a risk framework, not a certification you pass or fail. Enforza helps you implement and evidence the controls your firewall rules own — the boundary-protection (SC-7), information-flow (AC-4), least-privilege (AC-6), least-functionality (CM-7) and change-control (CM-3) families. It covers the network-control slice; the broader control set across your systems is your programme's responsibility.
How does Enforza implement deny-by-default (SC-7(5))?
Every section of an Enforza policy — inbound, east-west and outbound — defaults to drop, with traffic allowed only by explicit, scoped rules. The NIST pack includes a guardrail that flags any rule re-introducing a broad, unscoped allow, so the deny-by-default posture required by SC-7(5) is checked on every change rather than assumed to hold.
Can I evidence NIST controls for an assessor?
Yes. Every compliance check is recorded — the controls evaluated, what passed, what was advised, and any enforce block that rejected a change before it reached a firewall. That is defensible evidence for the SC, AC and CM controls your firewall implements. It evidences the network controls; the wider 800-53 baseline across your environment remains your responsibility.
How much does Enforza cost?
Enforza is a flat per-firewall licence — £179/month per firewall, dropping to £149 from your sixth — plus the VM you run it on, with no per-GB data-processing charge. Against a cloud-native firewall stacked with a NAT gateway, the flat line is typically 60–80% cheaper at modest egress. The NIST 800-53 and CSF packs and advise-or-enforce guardrails are part of the platform, not a paid add-on.
Boundary protection, handled.
Stop non-compliant rules before they ship.
Bundled NIST 800-53 r5 and CSF 2.0 packs, advise-or-enforce on every rule change, and a flat per-firewall price with no per-GB tax. Start free, no card.