A variety of security management measures are undertaken in order to fortify the information systems of critical infrastructures. However, there is little research on the time required to apply these measures. This study seeks to identify the typical sequence of activities for establishing firewall security management policies for information systems and then model the time required for each step. Based on this, a research methodology for measuring the work requirements of information security safety-bolstering activities can be designed. In order to operate and maintain the information systems of critical infrastructures, the services and ports that are to be designated as internal IPs must be established in advance. These security management policy settings are registered on the firewall located in front of each information system. Before this study, I defined the time required for firewall security policy management in critical infrastructures as Firewall Security Management Time (FSMT). FSMT comprises the security policy user application time and the security policy manager enrollment time. The ultimate goal of this study is to arrive at a formula to calculate FSMT by modeling firewall security management activities for important information systems of critical infrastructures.