SekitCrosswalk
ENES
Start now
Cyber Essentials · derived mapping target

CE3.1Use licensed and supported software

Run only software you are licensed to use and that the vendor still supports with security fixes. Remove or isolate software once it becomes unsupported so it no longer puts the network at risk.

Mapping at a glance
CE3.1Use licensed and supported softwareCyber Essentials
RCF-0040Software inventoryAsset Management · PolicyRCF-0041Software inventoryAsset Management · ProcessRCF-0042Software inventoryAsset Management · TechnicalRCF-0127Dependency/SBOM managementApplication Security · PolicyRCF-0128Dependency/SBOM managementApplication Security · Process

CE3.1 is covered by 10 Sekit CSF controls. +5 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0040Software inventory · PolicyRCF-0041Software inventory · ProcessRCF-0042Software inventory · TechnicalRCF-0127Dependency/SBOM management · PolicyRCF-0128Dependency/SBOM management · ProcessRCF-0139Container security · PolicyRCF-0140Container security · ProcessRCF-0155Patch management · ProcessRCF-0328Software supply chain (SBOM) · PolicyRCF-0329Software supply chain (SBOM) · Process

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.9 Inventory of information and other associated assetsA.8.8 Management of technical vulnerabilitiesA.8.9 Configuration managementA.5.1 Policies for information securityA.8.25 Secure development life cycleA.5.21 Managing information security in the ICT supply chainA.8.19 Installation of software on operational systemsA.5.32 Intellectual property rights

NIST CSF 2.0 counterparts

PR.PS-01 Configuration management appliedGV.SC-06 Due diligence before engagementID.AM-08 Assets managed through lifecyclePR.PS-02 Software maintainedID.AM-05 Assets prioritized by criticalityID.AM-02 Software inventory maintainedPR.PS-04 Logs generated for monitoringID.RA-01 Vulnerabilities identified and recorded

ISO/IEC 42001:2023 — Annex A counterparts

A.4.4 Tooling resources

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Software and SaaS inventory
The list of installed software and cloud apps the company uses, with their licences, and a sense of which tools people use that are not officially approved.
Patch management report
The proof that security updates are applied on time across devices and systems, with tracking of what is still outstanding.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

CE2.1 Remove unnecessary accounts and softwareCE3.2 Apply critical updates within 14 daysCE5.1 Operate a malware protection mechanismCE5.2 Restrict execution to approved software
Ask Sekura: “What evidence proves CE3.1?”
Also via MCP, free with account