Web security · appears in CAIQ, SIG, ISO 27001, SOC 2
Are HSTS, CSP, X-Frame-Options, and X-Content-Type-Options set on the public web endpoint?
Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).
How to answer this
Whichever verdict your domain earns, this is the wording to put in the response box. Reviewers mark an answer down for vagueness more often than for a "No", so say which state you are in and what evidences it.
- Yes
- The core security response headers are present on the public web endpoint
- Partial
- Some security headers are present; others are missing or weakly configured
- No
- The public web endpoint is missing required security response headers
Controls this evidences
| Framework | Control | Why it maps |
|---|---|---|
| SOC 2 | CC6.6 | HSTS, CSP, X-Frame-Options harden the browser security boundary. |
| ISO 27001 | A.8.23 | Securing application services on public networks. |
| NIST 800-53 | SC-7(8) | — |
Domain Posture is not an audit and does not replace an auditor. See methodology v1 for how each verdict is reached.
When a "Yes" stops being true
HSTS, CSP, or X-Frame-Options removed or weakened on the public endpoint.
That is the whole problem with answering a questionnaire from a screenshot: the answer was true the day you took it. A signed evidence pack is dated, and a schedule re-checks it so you find out before your reviewer does.