# Zero Trust and Secure Networking Standards · SEC-02

## Standard Metadata

- Area: Security
- Owner: Security group
- Last reviewed: 2026-09-09
- Next review due from: 2026-12-01
- Enforcement: Code review
- Status: Active

## Access to infrastructure must be granted using the principle of least privilege · SEC-02.1 · **MUST** · **DEV**

## Web applications should utilise a Web Application Firewall (WAF) to protect systems from common attacks · SEC-02.2 · **SHOULD** · **DEV**

This should always be presented as an option to clients, with benefits and costs clearly explained.

## Cloud-hosted applications should be deployed within an isolated virtual network · SEC-02.3 · **SHOULD** · **DEV**

This approach introduces additional cost and complexity, so should be presented as an option to clients for them to understand the pros and cons.