SIG Lite
Control IVS-03
Extractive Review Standard
How to answer 'Do you deploy a Web Application Firewall (WAF)?' on a SIG Lite
Reviewer Guidance & Pitfalls
Name the WAF provider (Cloudflare, AWS WAF) and state the rulesets enabled (OWASP Core Rule Set, managed IP reputation lists, rate limiting).
Example Answer Passing Enterprise Audit
Compliant Response Template
Yes. All public ingress traffic is routed through Cloudflare WAF configured with OWASP Core Rulesets, managed bot management, and automated rate limiting (SOC 2, CC6.6).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.