Should past malicious domains ever be removed from firewall blacklists? When should they?

My company receives cybersecurity intelligence, mainly in the form of malicious IPs, from local ISACs. The IT Team then feed these IPs in their firewalls so access from or to these addresses is blocked. Finally, the IS Team set these IPs in a SIEM alert to serve as a double check.

Now, after several months or even years, the employees might need to access websites with the same IPs, to conduct business or Anti-Money Laundering measures. Their access is blocked. …

blacklists cybersecurity domains firewall malicious