Guides · APRF practice notes
Cybersecurity Guides
Posture, checklists, and audit evidence—WAF rules, supply-chain inventory, SOC 2 control mapping, and access reviews. Complements the how-to Security guides; maps to APRF Infrastructure, Supply Chain, and Compliance.
Posture checklists, WAF, supply chain, and SOC 2 evidence — APRF Security & Compliance.
For implementation deep-dives on keys, IAM, injection, and throttles, see Security guides.
AI Production Readiness Framework
Related APRF controls
- Why Admin Access Is Dangerous in AWS
Admin access in AWS means one compromised key can delete everything. Here's why and how to fix it.
- AI Supply Chain: SBOM, Models, and MCP Verification
Your AI stack is a supply chain—models, SDKs, prompt packs, and MCP servers. If you cannot name and verify what you run, you fail APRF Supply Chain.
- Check If Your API Is Secure Online
A practical checklist to verify your API is secure—rate limiting, auth, keys in backend—then confirm with gated assessment.
- How Hackers Abuse Public APIs
Public APIs are high-value targets. Here's how attackers find and abuse them—and how to protect yours.
- Incident Response Plan for Startups
Startups need incident response too. Runbooks, escalation, communication. A simple plan that works.
- How to Restrict IAM Roles Properly
Overly permissive IAM roles create blast radius. Here's how to scope them to minimal permissions.
- SaaS Security Checklist
A free checklist to verify SaaS security basics—rate limiting, auth, backups, logging—plus APRF gates when you are ready to pass/fail.
- Simple API Security Checklist
A practical API security checklist for startups. Rate limiting, auth, keys in backend, and more.
- SOC2 Security Controls for Startups
SOC2 security controls for startups: access control, encryption, backups, monitoring. A practical path to compliance.
- WAF Rules for API Protection
Use WAF rules to protect your API. Block bad user agents, datacenter IPs, and known attack patterns.
Next: Infrastructure
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.