WAF (identified above) - SSL/TLS configuration and certificate authority - Security headers - Authentication mechanisms (SSO, OAuth, SAML)