What sources do you use to add credibility to your work after an audit of firewall rule-set ?

What sources do you use to arguments your consideration ?