Start with ownership and intent
A rule can be technically active while its business purpose has disappeared. Cleanup therefore needs application owners, traffic evidence, change history, expiration dates, and a documented reason for retained access.
Group rules by service, owner, environment, and risk. Flag any-any access, broad address groups, disabled rules, duplicate objects, shadowed policies, temporary changes, and rules without logging.
Use staged controls
Do not delete uncertain rules in bulk. Add logging where safe, observe representative business cycles, narrow objects, apply schedules or expiry, disable before deleting, and keep a rollback record.
Usage counters alone are incomplete. Seasonal processing, disaster-recovery paths, vendor support, certificate renewal, and month-end workflows may be quiet during a short observation window.
- Confirm owner
- Capture purpose
- Review traffic evidence
- Assess exposure
- Approve the change
- Validate after change
Make recertification repeatable
The long-term improvement is a policy lifecycle: named owners, ticket references, review dates, logging expectations, documented exceptions, and consistent object naming.
A smaller rulebase is helpful, but an accountable rulebase is the real objective.