6.6 For public-facing web applications, are new threats and Review documented vulnerabilities addressed on an ongoing basis, and are processes these applications protected against known attacks by Interview personnel applying either of the following methods? Examine records of application Reviewing public-facing web applications via manual security assessments or automated application vulnerability security Examine system configuration assessment or methods, as follows: settings At least annually After any changes By an organization that specializes in application security That, at a minimum, all vulnerabilities in Requirement 6.5 are included in the assessment That all vulnerabilities are corrected That the application is re-evaluated after the corrections Note: This assessment is not the same as the vulnerability scans performed for Requirement 11.2. OR – – Installing an automated technical solution that detects and prevents web-based attacks (for example, a firewall) as follows: Is situated in front of public-facing web applications to detect and prevent web-based attacks. Is actively running and up to date as applicable. Is generating audit logs. Is configured to either block web-based attacks, or generate an alert that is immediately investigated.
6.6 For public-facing web applications, are new threats and vulnerabilities addressed on an ongoing basis, and are these applications protected against known attacks by applying either of the following methods? Reviewing public-facing web applications via manual or automated application vulnerability security assessment or methods, as follows: At least annually After any changes By an organization that specializes in application security That, at a minimum, all vulnerabilities in Requirement 6.5 are included in the assessment That all vulnerabilities are corrected That the application is re-evaluated after the corrections Note: This assessment is not the same as the vulnerability scans performed for Requirement 11.2. – OR – Installing an automated technical solution that detects and prevents web-based attacks (for example, a firewall) as follows: Is situated in front of public-facing web applications to detect and prevent web-based attacks. Is actively running and up to date as applicable. Is generating audit logs. Is configured to either block web-based attacks, or generate an alert that is immediately investigated. Review documented processes Interview personnel Examine records of application security assessments Examine system configuration settings
SAQ_D.docx