Control: ism-1862; Revision: 0; Updated: Jun-23; Applicability: ALL; Essential Eight: N/A ​

If using a WAF, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks.