diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
new file mode 100644
index 000000000000..5e6ad7a3413f
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
@@ -0,0 +1,12 @@
+# platform = multi_platform_all
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+- name: Ensure firewalld default zone is drop
+  lineinfile:
+    path: /etc/firewalld/firewalld.conf
+    regexp: '^DefaultZone='
+    line: 'DefaultZone=drop'
+    create: yes
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh
new file mode 100644
index 000000000000..f72edba49329
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh
@@ -0,0 +1,7 @@
+# platform = multi_platform_all
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+{{{ bash_replace_or_append('/etc/firewalld/firewalld.conf', '^DefaultZone', 'drop', '%s=%s') }}}
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
new file mode 100644
index 000000000000..24b0210c54a0
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
@@ -0,0 +1,48 @@
+<def-group>
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
+    {{{ oval_metadata("Firewalld Must Employ a Deny-all, Allow-by-exception Policy") }}}
+    <criteria operator="AND">
+      <criterion comment="firewalld default zone is drop" test_ref="test_firewalld_default_zone_drop" />
+      <criteria operator="OR">
+        <criterion comment="firewalld default zone has target DROP in /etc" test_ref="test_firewalld_default_zone_target_drop_etc" />
+        <criterion comment="firewalld default zone has target DROP in /usr" test_ref="test_firewalld_default_zone_target_drop_usr" />
+      </criteria>
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test id="test_firewalld_default_zone_drop" version="1" check="all" check_existence="all_exist" comment="Ensure DefaultZone is drop">
+    <ind:object object_ref="object_firewalld_default_zone_drop" />
+    <ind:state state_ref="state_firewalld_default_zone_drop" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_firewalld_default_zone_drop" version="1">
+    <ind:filepath>/etc/firewalld/firewalld.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^DefaultZone=drop$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_firewalld_default_zone_drop" version="1">
+    <ind:text datatype="string" operation="pattern match">^DefaultZone=drop$</ind:text>
+  </ind:textfilecontent54_state>
+
+  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_etc" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /etc">
+    <ind:object object_ref="object_firewalld_default_zone_target_drop_etc" />
+  </ind:xmlfilecontent_test>
+
+  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_usr" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /usr">
+    <ind:object object_ref="object_firewalld_default_zone_target_drop_usr" />
+  </ind:xmlfilecontent_test>
+
+  <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_etc" version="1">
+    <ind:path>/etc/firewalld/zones</ind:path>
+    <ind:filename>drop.xml</ind:filename>
+    <ind:xpath>/zone[@target='DROP']</ind:xpath>
+  </ind:xmlfilecontent_object>
+
+  <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_usr" version="1">
+    <ind:path>/usr/lib/firewalld/zones</ind:path>
+    <ind:filename>drop.xml</ind:filename>
+    <ind:xpath>/zone[@target='DROP']</ind:xpath>
+  </ind:xmlfilecontent_object>
+
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
new file mode 100644
index 000000000000..bcdeeadfb82f
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# packages = firewalld
+# platform = multi_platform_all
+
+mkdir -p /etc/firewalld/zones
+touch /etc/firewalld/firewalld.conf
+if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
+    sed -i "s/^DefaultZone=.*/DefaultZone=drop/" /etc/firewalld/firewalld.conf
+else
+    echo "DefaultZone=drop" >> /etc/firewalld/firewalld.conf
+fi
+
+cat << EOF > /etc/firewalld/zones/drop.xml
+<?xml version="1.0" encoding="utf-8"?>
+<zone target="DROP">
+  <short>Drop</short>
+  <description>Unsolicited incoming network packets are dropped.</description>
+</zone>
+EOF
+
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
new file mode 100644
index 000000000000..112810d2f08a
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# packages = firewalld
+# platform = multi_platform_all
+
+mkdir -p /etc/firewalld/zones
+touch /etc/firewalld/firewalld.conf
+if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
+    sed -i 's/^DefaultZone=.*/DefaultZone=public/' /etc/firewalld/firewalld.conf
+else
+    echo "DefaultZone=public" >> /etc/firewalld/firewalld.conf
+fi
\ No newline at end of file