Requirement
[A: M | B: R] Cybersecurity requirements for protecting the entity's external web applications must be defined, documented and approved, covering at minimum:
Sub-Controls
2-15-1-1
Requirement: [A: M | B: R] Use of a Web Application Firewall.
2-15-1-2
Requirement: [A: M | B: R] Use of the multi-tier architecture principle.
2-15-1-3
Requirement: [A: M | B: R] Use of secure protocols (e.g., HTTPS).
2-15-1-4
Requirement: [A: M | B: R] Clarifying the secure usage policy to users.
2-15-1-5
Requirement: [A: M | B: R] User authentication, with the appropriate authentication factors, their number, and the appropriate authentication techniques determined based on the results of assessing the potential impact of authentication failure or bypass, for user login operations.
