How to answer 'Do you deploy a Web Application Firewall (WAF)?' on a SIG Lite
I. Reviewer Guidance & Pitfalls
Name the WAF provider (Cloudflare, AWS WAF) and state the rulesets enabled (OWASP Core Rule Set, managed IP reputation lists, rate limiting).
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · IVS-03
Yes. All public ingress traffic is routed through Cloudflare WAF configured with OWASP Core Rulesets, managed bot management, and automated rate limiting (SOC 2, CC6.6).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default