Sekit CSF · Application Security · Technical
RCF-0138API security
Technical controls enforce authentication, authorisation and rate limiting on all API endpoints
Mapping at a glance
RCF-0138API securityApplication Security · Technical
RCF-0138 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.15Access controlsupportsEnforcing authentication, per-endpoint authorisation and rate limiting on APIs is A.5.15's access control principle applied to machine-to-machine access, not only human logins.A.8.5Secure authenticationsupportsAPI endpoints enforce authentication and per-endpoint authorization technically, extending A.8.5's secure-authentication requirement beyond human sign-in to machine-to-machine access.A.8.26Application security requirementssupportsThe technical facet enforces authentication, per-endpoint authorization and rate limiting on every API endpoint, the concrete control A.8.26's requirements exist to produce.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
PR.AA-05Access permissions managedPR.PS-01Configuration management appliedPR.PS-04Logs generated for monitoring
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Application security testing evidence
The proof that code and applications are automatically scanned for flaws (SAST/DAST), including dependencies and APIs.
From the Sekit evidence catalog
This topic through the other lenses
All Application Security controls
Ask Sekura: “What evidence proves RCF-0138?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.