Sekit CSF · Application Security · Policy
RCF-0127Dependency/SBOM management
The company formally tracks all software components and third-party libraries used in its applications
Mapping at a glance
RCF-0127Dependency/SBOM managementApplication Security · Policy
A.5.1Policies for information securityISO/IEC 27001:2022 · Annex A controlsA.5.9Inventory of information and other associated assetsISO/IEC 27001:2022 · Annex A controlsA.8.8Management of technical vulnerabilitiesISO/IEC 27001:2022 · Annex A controlsGV.SC-06Due diligence before engagementNIST CSF 2.0ID.AM-08Assets managed through lifecycleNIST CSF 2.0
RCF-0127 maps to 8 controls across the published frameworks. +3 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsSekit's Dependency and SBOM management policy, one of A.5.1's topic-specific policies, mandates that every third-party component used in company applications is inventoried and accounted for.A.5.9Inventory of information and other associated assetssupportsThis policy control mandates that every third-party component in company applications is inventoried, extending A.5.9's asset inventory into software dependencies.A.8.8Management of technical vulnerabilitiessupportsThis policy facet mandates that every third-party component be inventoried, the software-composition leg of A.8.8's exposure that dependency vulnerabilities depend on.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.SC-06Due diligence before engagementID.AM-08Assets managed through lifecyclePR.PS-01Configuration management applied
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Application security testing evidence
The proof that code and applications are automatically scanned for flaws (SAST/DAST), including dependencies and APIs.
From the Sekit evidence catalog
This topic through the other lenses
All Application Security controls
Ask Sekura: “What evidence proves RCF-0127?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.