Plan · What should be running, and what is?
For a firewall, I need to know more than what is in its configuration file. I distinguish the intended state, the deployed configuration and the rules that are actually active.
In the project: The checking workflow compares intended rules, configuration and active state.
A concrete question instead of an assumption that everything matches.