Been there, done that. Still a lot of checkboxes. The auditor will not likely to really understand the details of your setup. E.g. you can install firewall with

Been there, done that. Still a lot of checkboxes. The auditor will not likely to really understand the details of your setup. E.g. you can install firewall with all ports open, then document this setup, justified business reasons. And then it is technically enough to complete section 1. Of course it would not anything extra to your security.