Sekit CSF · Application Security · Technical
RCF-0129Dependency/SBOM management
Technical tools automatically identify vulnerable dependencies and alert or block affected builds
Mapping at a glance
RCF-0129Dependency/SBOM managementApplication Security · Technical
RCF-0129 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.8.8Management of technical vulnerabilitiessupportsThe technical facet runs automated dependency scanning that flags or blocks builds containing known-vulnerable components, a direct source of A.8.8's technical vulnerability data.A.8.29Security testing in development and acceptancesupportsThe Sekit technical control runs automated dependency scanning that flags or blocks builds with known-vulnerable components, a specific test this ISO control requires before acceptance.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.SC-06Due diligence before engagementID.AM-08Assets managed through lifecyclePR.PS-01Configuration management applied
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Application security testing evidence
The proof that code and applications are automatically scanned for flaws (SAST/DAST), including dependencies and APIs.
From the Sekit evidence catalog
This topic through the other lenses
All Application Security controls
Ask Sekura: “What evidence proves RCF-0129?”
Also via MCP, free with account