Who should be able to change our firewall, and should we have access ourselves?

This is the question underneath the complaint about slow changes, and it is worth separating from it, because the answer matters even when response times are good.

The principle: the business should always have a route to its own equipment. Not necessarily you personally clicking around in a firewall, which is how most self-inflicted outages happen. But there should be at least one party you can reach, at a time you can reach them, with the access and the competence to make a change. If the only route runs through a queue you cannot escalate, you have a single point of failure that has nothing to do with the hardware.

The questions to ask whoever manages your firewall, including us:

• Is the equipment registered to our organization or to yours? On cloud managed platforms like Meraki, devices belong to an organization in the vendor's dashboard. If that organization is your provider's, your gear is inside an account you do not control, and that has consequences well beyond change requests.
• Can we be given administrative access if we ask, and is there a charge? A reasonable provider will say yes. Watch for the answer that it is not possible, which usually means not possible for them rather than not technically possible.
• If we are not given access, who can act and when?
• Do we get a copy of the configuration and the documentation? This one is a good test of a provider generally.

What we do. You own your equipment and the account it lives in. If you want administrative access, you get it, at no charge, and we will tell you honestly which changes are safe to make yourself and which ones are how people take their own office offline on a Friday afternoon. The documentation is yours and you get a copy. If you leave us, you take all of it, and there is a separate article on exactly what that looks like.

Our strong preference is still that you call us rather than making changes yourself, not because of control but because an undocumented rule somebody added at 7pm is genuinely difficult to unpick two years later. The point is that the ability exists and the business is never stuck.