6.4.2 For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following: • Is installed in front of public-facing web applications and is configured
For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following: • Is installed in front of public-facing web applicati.
system holds itEvidence a system already holds
- Evidence of the automated technical solution installed in front of public-facing web applications · Document repository
- Configuration showing it is set to detect and prevent web-based attacks rather than to log only · SIEM / log platform
- Evidence it is actively running and up to date, with the version or ruleset in use · Document repository
- Audit logs generated by the solution, and evidence they are retained and reviewed · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Coverage evidence reconciling protected applications against the public-facing application inventory · Policy repository / GRC workspace
First move
Common gaps auditors find
- Solution deployed in detection mode indefinitely because blocking risks false positives, so it never prevents
- Applications reachable by a path that bypasses the solution, such as a direct origin address
- Rulesets left at deployment defaults with no update process, so new attack classes are unaddressed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via manual or automated application · 6.4.3 All payment page scripts that are loaded and executed in the consumer's browser are managed as follows: • A method is implemented to confirm that each script is authorized. • A method is implemented