When ever CIS detects a new network you can specify if this network is trusted or not, if it is CIS will add certain rules. Now if for whatever reason you decide that, that network is not trusted anymore, currently you have to manually delete previously created rules for that network (and re-create them if for whatever reason you change your mind again). So I suggest adding “trusted” checkbox next to any network listed in network zones, so that CIS will create \ delete needed rules when you check \ uncheck it.