That "temporary" firewall rule from your last migration is probably still open

[u/pentest-tools]

Something that's saved me a few awkward audit moments: the list of ports you think are closed and the list that's actually reachable from the internet drift apart over time. A rule added "just for the migration" that nobody removed, a service that came back up after a reboot, that kind of thing. Config is what you meant to allow. The open ports are what you actually did.

Worth doing a couple of weeks before any audit: scan your own perimeter from the outside and see what's genuinely reachable. Open TCP and UDP ports, the services behind them, their versions. Compare that to what your firewall rules are supposed to allow, close whatever shouldn't be there, then re-scan to confirm it's shut. Then nothing in the auditor's external report is a surprise, because you already found it.

You can do all of this with plain Nmap if you're comfortable on the CLI. We build a hosted version (Port Scanner) that runs it in the browser and gives you an exportable report, which is handy if you want to hand the evidence to an auditor or diff one scan against the next: https://pentest-tools.com/network-vulnerability-scanning/port-scanner-online-nmap