Services › Firewall Management

Managed service · Sophos firewall

Someone sold you a firewall. Nobody owns it.

Sophos Firewall Administration & Assurance is a remote managed service with a named engineer accountable for your firewall's configuration state — health checks on a schedule, firmware kept current, the rule base reviewed, and every change recorded. So when the auditor asks, you have an answer.

Audited Patched Documented Defensible

Start with the assessment See the tiers

Your firewall, twelve months on

0 / 10

Bricks fallen out

0 / 10

Bricks replaced

Solid Loosening — same on both Hole

Ten bricks loosened on both walls. One of them had somebody looking after it.

The gap

Four things that go wrong when nobody's accountable

We see these in nearly every SMB estate we assess. None of them announce themselves. They compound.

↓

Firmware drifts

Patches go unapplied for months. Nobody tracks the vendor's supported release train.

≡

The rule base rots

Rules accumulate, nothing is removed. Any-any rules quietly survive from the install.

Changes go unrecorded

No log of who asked, who changed, or why. Nothing to hand an auditor.

⊘

Protection isn't applied

IPS and web control are licensed and paid for — but not attached to the rules that matter.

This is an ownership gap, not a detection gap. It doesn't need a SOC. It needs an engineer who is accountable.

Positioning

What this service is — and what it isn't

✓ What we do

Own the firewall's configuration state — with a named engineer
Scheduled health checks, firmware currency, and rule review
Maintained change log & configuration version history
Annual rule-base certification for your auditor
Capped, predictable annual commercials

✕ What we do not

24×7 monitoring or a staffed SOC
Managed Detection & Response (MDR) or threat hunting
Incident response, forensics, or breach containment
Sophos licence supply — quoted & billed separately
Hardware RMA, on-site attendance, or non-Sophos devices

We say no to the things we cannot staff. That is why the yes is worth something.

Engagement

It starts with an assessment. Always.

Posture Assessment

3–5 days

Remediation & Baseline

Scoped

Transition to Managed

5 days

Steady-State Management

12 months

Annual Certification

Month 12

The assessment is never free. It's credited against Year 1 contract value if you sign at readout. We don't assume management of a firewall whose baseline hasn't been established and documented — that's how you inherit someone else's problems silently.

Service tiers

Three tiers. Pick by complexity, not company size.

Three questions — none of them about how big you are. Answer honestly and we'll point you at the tier that fits, not the biggest one.

01How many firewalls do you run?

02How often do your firewall rules actually change?

03Any audit or compliance pressure?

SIMPLE ESTATECOMPLEX ESTATE

—

Answer the three questions above We'll show you the tier that fits and what's in it.

This is an indication, not a quote. Your rate card is issued with your proposal, after the assessment. Book a scoping call

Change log & annual rule-base certification are included at every tier. Allowances pool across multi-firewall estates.

	EssentialThe floor	MOST ESTATES StandardNamed engineer	AdvancedHigh change
Health check	Quarterly	Monthly	Monthly
Changes / month	2	4	8
Firmware	Advisory	Scheduled windows	Scheduled + rollback
Rule review	Annual	Half-yearly	Quarterly
Reporting	Annual	Half-yearly	Quarterly + call
Acknowledgement	Next business day	8 business hrs	4 business hrs
Engineer	Shared	Named	Named + backup
Change log	✓	✓	✓
Rule-base certification	✓	✓	✓

Why it matters

Two byproducts your auditor will ask for

Included at every tier

Change log & version history

Every change recorded: requestor, justification, engineer, timestamp, and the resulting config version. A contemporaneous evidence trail over a critical security asset.

ISO 27001 change-control evidence
NABH / ABDM system control expectations
DPDP Act & IT Act / SPDI reasonable security practices

Month 12

Annual rule-base certification

A signed attestation at month 12: the rule base reviewed in full, permissive rules dispositioned, and the resulting posture documented and accepted.

Presentable to customers and regulators
Shortens your own audit evidence effort
Available standalone, without a contract

These are byproducts of disciplined administration — which is exactly why no box reseller produces them.

Response targets

Honest targets, not theatre

Priority	Definition	Acknowledgement	Available on
P1	Firewall down / total loss of connectivity	4 business hrs	Advanced
P2	Degraded service or partial outage	8 business hrs	Standard +
P3	Change request / configuration query	Next business day	All tiers
P4	Advisory / scheduled work	3 business days	All tiers

Read this carefully — we'd rather you did. These are best-effort acknowledgement targets during business hours. They are not penalty-backed SLAs, and no service credits attach. They measure time to acknowledge and confirm an action plan — not guaranteed resolution. Business hours are Mon–Fri, 09:30–18:30 IST, excluding Karnataka public holidays.

Commercials

Per firewall. Per year. No surprises.

₹

Per firewall, per year

Billed annually in advance. No per-incident billing — it misaligns incentives and makes your cost unpredictable.

◲

Change requests capped

Explicit per-tier allowances. Uncapped change is how service quality quietly degrades.

⧉

Allowances pool

Multiple firewalls? Requests pool across the estate, with a volume adjustment from unit two.

⊞

Licence cost separate

Sophos renewal is quoted separately. You always see what you pay us versus what you pay Sophos.

RATE CARD ISSUED WITH THE PROPOSAL · ALL FEES IN INR, EXCLUSIVE OF GST

Straight answers

Questions we get asked

Why isn't the assessment free?+

Because free audits get filed and forgotten. A paid assessment gets read, argued with, and acted on — and it's credited against Year 1 contract value if you sign at readout. It also protects you: we won't take over a firewall whose baseline we haven't established, because that's how inherited problems become your problems.

Is this a SOC or monitoring service?+

No, and we won't pretend otherwise. There's no 24×7 monitoring, no MDR, no threat hunting, and no incident response. This service owns your firewall's configuration state — that it's patched, that the rules are right, that changes are recorded, and that you can prove it. If you need detection and response, you need a different service, and we'll say so.

Do you supply Sophos licences?+

Licence supply is quoted and billed separately from this service, deliberately. You should always be able to see what you pay us for engineering versus what you pay Sophos for software. Bundling the two hides one inside the other.

What happens if we exceed the change allowance?+

Allowances are per-tier and explicit, and they pool across multiple firewalls. If you're consistently over, that's a signal you're on the wrong tier — we'd rather move you up than quietly degrade service or surprise you with a bill.

Can we get the rule-base certification without a contract?+

Yes. The annual rule-base certification is available standalone — useful if you have an audit coming and need a defensible attestation over your firewall. It's also included at every managed tier.

Which firewalls do you manage?+

Sophos, managed via Sophos Central. Non-Sophos devices are out of scope for this service — not because we can't learn them, but because depth on one platform is what makes the assurance credible. If you're on another platform, talk to us about an audit instead.

Next step

Start with the assessment.

Three to five days. Remote, read-only, zero availability impact. You keep everything it produces — whether or not you go further with us:

A findings report
A prioritised remediation roadmap
A full rule-base inventory
A documented baseline

Book a scoping call hello@indicshield.ai AUDITED · PATCHED · DOCUMENTED · DEFENSIBLE

Service reference ISH-SVC-MFS-001 · Posture assessment ISH-SVC-FPA-001. Sophos and Sophos Central are trademarks of Sophos Ltd. Indic Shield Technologies is an independent service provider; this page describes our administration service, not a Sophos offering. Response targets are best-effort acknowledgement targets, not penalty-backed SLAs.