When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns on the rule analyzed.
In this report, you need to write what is wrong in the rule-set and the security consideration about the configuration.
For example, if in the rules you have not find egress filtering you can say it's a problem because from your network is possible to do spoofing.
What sources do you use to add credibility and customer satisfaction to your work after an audit and a report of this kind ?
What reliable sources, best practice, etc .. do you use to arguments your consideration to show to your client that this consideration is not your own consideration by a widely accepted consideration in the security industry ?