Kuwait NCF Protect function (Infrastructure). Network Security and Segmentation: defense in depth + perimeter (firewall + WAF + DDoS mitigation) + internal segmentation (microsegmentation + VLAN + zero-trust network access ZTNA) + east-west traffic inspection + secure remote access (VPN with MFA + SASE + Secure Web Gateway SWG + CASB) + DNS security + DNSSEC + network detection and response (NDR) + DMZ architecture + cloud network security (VPC + security groups + NACL). Secure Configuration and Vulnerability Management: configuration baselines (CIS Benchmarks + DISA STIG + vendor guidance) + golden images + Infrastructure-as-Code (IaC) + drift detection + configuration management + vulnerability scanning (network + application + container + cloud + database) + patch management SLAs by severity + emergency patch procedures + virtual patching (WAF) + zero-day response + bug bounty programmes. Secure Software Development (SDLC): security requirements + threat modeling (STRIDE + PASTA + LINDDUN for privacy) + secure coding (OWASP) + Static (SAST) + Dynamic (DAST) + Interactive (IAST) Application Security Testing + Software Composition Analysis (SCA) + container scanning + secrets scanning + signed artefacts + supply chain security (SBOM + SLSA) + DevSecOps pipeline + security gates + Software Bill of Materials. Physical and Environmental Security: data centre Tier III/IV + biometric access + CCTV + environmental controls (temperature + humidity + fire + flood + power) + Visitor Management + Equipment Disposal + Media Sanitisation NIST SP 800-88 + secure decommissioning + Kuwait NCSC physical security requirements for CNI.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.