Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

A security administrator should adhere to a change management procedure when setting up new firewall rules. This ensures that all changes are documented, reviewed, tested, and approved before implementation, minimizing the risk of introducing vulnerabilities or disrupting services. Without a formal process, unauthorized or poorly configured rules could lead to security gaps or network outages. The disaster recovery plan (DRP) focuses on restoring operations after a catastrophic event, not routine changes. An incident response procedure (IRP) outlines steps to take during a security incident, which is reactive, not proactive for rule changes. A business continuity plan (BCP) ensures critical business functions continue during disruptions, but doesn't govern the technical process of implementing changes.