For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by either of the following methods:

• Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods, at least annually and after any changes

• Installing an automated technical solution (for example, a web application firewall) that detects and prevents web-based attacks in front of public-facing web applications, to continually check all traffic

• How SAKA meets this requirement: This requirement must be fulfilled by customer sites if they choose to place the SAKA appliance facing the public web.