diff --git a/controls/cis_rhel9.yml b/controls/cis_rhel9.yml
index 954bd8b7f53..6bdef6f42ee 100644
--- a/controls/cis_rhel9.yml
+++ b/controls/cis_rhel9.yml
@@ -1087,6 +1087,7 @@ controls:
     status: automated
     rules:
       - service_firewalld_enabled
+      - package_firewalld_installed
       - service_nftables_disabled
 
   - id: 3.4.2.1
diff --git a/linux_os/guide/system/network/network-firewalld/firewalld_activation/package_firewalld_installed/rule.yml b/linux_os/guide/system/network/network-firewalld/firewalld_activation/package_firewalld_installed/rule.yml
index c9c8d7a2ff5..93351b2038e 100644
--- a/linux_os/guide/system/network/network-firewalld/firewalld_activation/package_firewalld_installed/rule.yml
+++ b/linux_os/guide/system/network/network-firewalld/firewalld_activation/package_firewalld_installed/rule.yml
@@ -31,6 +31,7 @@ references:
     cis@alinux3: 3.4.1.1
     cis@rhel7: 3.5.1.1
     cis@rhel8: 3.4.1.1
+    cis@rhel9: 3.4.1.2
     cis@sle15: 3.5.1.1
     disa: CCI-002314
     nist: CM-6(a)