1. A computer-implemented method for producing a firewall rule set comprising: receiving a declarative policy associated with a computer network security policy, the declarative policy being high risk assets are not allowed to communicate with high value assets, the high risk assets being at least insecure assets, the high value assets comprising customer data, the declarative policy including at least one predetermined category and action associated with the at least one predetermined category, the at least one predetermined category indicating a plurality of workloads, the action being at least one of forward, block, redirect, and log; collecting information from at least one external system of record, the information associated with the at least one predetermined category; generating a firewall rule set using the declarative policy and the information, the firewall rule set including workload addresses to or from which network communications are at least one of forwarded, blocked, redirected, and logged, the firewall rule set being at a lower level of abstraction than the declarative policy; and provisioning the firewall rule set to a plurality of enforcement points of a distributed firewall, each enforcement point policing the network communications among respective workloads using the firewall rule set, the provisioning including sending an update to at least one hypervisor, the update including the firewall rule set.