Can we specify and enforce custom rules in ECC firewall with out Vault product?

[Harish V]

Vault product documentation and setting up code signing has a documentation around modifying boot-config.yaml file to allow or reject incoming messages. Does this only work if Vault plugins are activated? Product docs here - 

https://docs.servicenow.com/bundle/vancouver-platform-security/page/administer/encryption/task/custo...