What actually needs a firewall change, and how often does it come up?

People underestimate this because a firewall feels like something you set up once. In practice, at a business of twenty or thirty people, something needs a rule changed every few weeks. The list from an ordinary year:

• A new cloud application staff cannot reach. You bought it, everyone is signed up, and it does not connect from the office. Work stops for the people who were supposed to start using it today.
• A vendor needs a port opened for their equipment. The alarm company, the camera installer, the time clock, the payment terminal, the access control system. They are onsite, they are billing you for the visit, and they are standing there waiting.
• A device that sends data outside. Dental and veterinary imaging going to a lab or a specialist, a backup appliance replicating offsite, a monitoring system reporting in.
• A connection to a second location or a partner. New office, new warehouse, a client who requires a dedicated link.
• Content filtering blocking something legitimate. A supplier's portal, a bank, a government filing site, a training video. Someone needs it right now, not tomorrow.
• A copier that stopped scanning to email after the vendor updated it, which is a firewall and mail flow question combined.
• Guest Wi-Fi for an event, usually needed this afternoon.
• Someone traveling or working from home who needs to reach something inside the office.
• Blocking something urgently, during a security incident. There is a separate article on that one, because it is the version where hours genuinely cost you money.

None of these are complicated. Most are ten minutes of work for someone who knows the network. The question is never whether the change is hard, it is how long it sits before anyone looks at it, and whether the person who looks at it understands why you asked.

The practical test before you sign anything. Count how many of the items above happened to you in the last twelve months. If the answer is none, a carrier managed network may suit you perfectly well and there is an article in this knowledge base that says so. If the answer is six or eight, that is six or eight occasions a year where the turnaround commitment is the whole value of the service, and it is worth getting that number in writing before you commit.