SekitCrosswalk
ENES
Start now
Cyber Essentials · derived mapping target

CE2.1Remove unnecessary accounts and software

Disable or delete user accounts, applications, system utilities and services that are not required for a device to do its job, since each one is a potential way in for an attacker.

Mapping at a glance
CE2.1Remove unnecessary accounts and softwareCyber Essentials
RCF-0041Software inventoryAsset Management · ProcessRCF-0042Software inventoryAsset Management · TechnicalRCF-0058Shadow IT discoveryAsset Management · PolicyRCF-0059Shadow IT discoveryAsset Management · ProcessRCF-0060Shadow IT discoveryAsset Management · Technical

CE2.1 is covered by 21 Sekit CSF controls. +16 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0041Software inventory · ProcessRCF-0042Software inventory · TechnicalRCF-0058Shadow IT discovery · PolicyRCF-0059Shadow IT discovery · ProcessRCF-0060Shadow IT discovery · TechnicalRCF-0140Container security · ProcessRCF-0145Configuration baselines · PolicyRCF-0146Configuration baselines · ProcessRCF-0160Device hardening · PolicyRCF-0161Device hardening · ProcessRCF-0162Device hardening · TechnicalRCF-0223Configuration management · PolicyRCF-0224Configuration management · ProcessRCF-0226Baseline compliance · PolicyRCF-0227Baseline compliance · ProcessRCF-0332Shared responsibility model · ProcessRCF-0333Shared responsibility model · TechnicalRCF-0338CSPM posture · ProcessRCF-0339CSPM posture · TechnicalRCF-0346Workload protection · PolicyRCF-0353SaaS security configuration · Process

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.9 Configuration managementA.5.1 Policies for information securityA.5.9 Inventory of information and other associated assetsA.8.16 Monitoring activitiesA.5.23 Information security for use of cloud servicesA.5.10 Acceptable use of information and other associated assetsA.5.36 Compliance with policies, rules and standards for information securityA.5.22 Monitoring, review and change management of supplier servicesA.8.1 User endpoint devicesA.8.19 Installation of software on operational systemsA.8.25 Secure development life cycleA.5.32 Intellectual property rights

NIST CSF 2.0 counterparts

PR.PS-02 Software maintainedPR.PS-01 Configuration management appliedID.AM-02 Software inventory maintainedDE.CM-01 Networks monitoredID.AM-01 Hardware inventory maintainedID.AM-08 Assets managed through lifecycleID.AM-05 Assets prioritized by criticalityID.RA-01 Vulnerabilities identified and recordedGV.OC-04 Critical objectives and services understoodGV.SC-01 Supply chain risk program establishedGV.SC-05 Supply chain requirements in contractsPR.IR-01 Networks protected from unauthorized accessPR.PS-04 Logs generated for monitoring

ISO/IEC 42001:2023 — Annex A counterparts

A.4.4 Tooling resourcesA.10.2 Allocation of responsibilities

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Software and SaaS inventory
The list of installed software and cloud apps the company uses, with their licences, and a sense of which tools people use that are not officially approved.
Device hardening baseline
The secure-configuration standard applied to devices when handed out (default settings, disabled services) and how compliance is checked.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

CE2.2 Change default and guessable passwordsCE2.3 Enforce device unlocking credentialsCE3.1 Use licensed and supported softwareCE3.2 Apply critical updates within 14 daysCE4.3 Require multi-factor authenticationCE5.1 Operate a malware protection mechanismCE5.2 Restrict execution to approved software
Ask Sekura: “What evidence proves CE2.1?”
Also via MCP, free with account