For organizations attempting to secure their Web applications to meet compliance standards, PCI regulations present a choice of two options: Perform a code review or install a WAF. This, however, is a false choice. The best course of action is to do both. Requirement 6.6 of PCI DSS specifies the means for protecting Web-facing applications, either by "Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security" or by :installing an application layer firewall in front of Web-facing applications." This short-worded requirement has raised one of the largest PCI debates: Which method should be put in place, a code review or a Web application firewall (WAF)?