NACL is the backup security layer.

From AWS Docs:

SG: If you need an additional layer of security, you can create a network ACL and add rules.

NACL:You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.