2 of 4 added 676 characters in body

When you make a revision of rules on a firewall, how do you add credibility to your final consideration ?

When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns on the rule analyzed.

In this report, you need to write what is wrong in the rule-set and the security consideration about the configuration.

For example, if in the rules you have not find egress filtering you can say it's a problem because from your network is possible to do spoofing.

What sources do you use to add credibility to your work after an audit and a report of this kind ?

What reliable sources, best practice, etc .. do you use to arguments your consideration to show to your client that this consideration is not your own consideration by a widely accepted consideration in the security industry ?