Saudi NCA ECC 2-15-3-1: 2-15-3-1 Web application firewall

A web application firewall is used. This applies to purchased and internally developed external applications; for third-party operated applications the supplier must show a WAF is used.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in 2-15 Web Application Security – Saudi NCA ECC

2-15-1 2-15-1 External web application protection requirements defined
2-15-2 2-15-2 External web application protection implemented
2-15-3-2 2-15-3-2 Multi-tier architecture
2-15-3-3 2-15-3-3 Secure protocols such as HTTPS
2-15-3-4 2-15-3-4 Secure usage policy published for users
2-15-3-5 2-15-3-5 User authentication by impact assessment
2-15-4 2-15-4 Web application requirements reviewed

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Saudi NCA ECC controls