The internal network of the organization shall be physically and logically isolated from the Internet and any other external connection by a firewall. (3) All firewalls shall be subjected to thorough test for vulnerability prior to being put to use and at least half-yearly thereafter. (4) All web servers for access by Internet users shall be isolated from other data and host servers. 19.