SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

PR.PS-01Configuration management applied

Establish and apply secure configuration baselines so systems start hardened and stay that way, rather than running with risky default settings.

Mapping at a glance
PR.PS-01Configuration management appliedNIST CSF 2.0
RCF-0115Secure SDLC policyApplication Security · PolicyRCF-0116Secure SDLC policyApplication Security · ProcessRCF-0117Secure SDLC policyApplication Security · TechnicalRCF-0118Threat modelingApplication Security · PolicyRCF-0119Threat modelingApplication Security · Process

PR.PS-01 is covered by 57 Sekit CSF controls. +52 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0115Secure SDLC policy · PolicyRCF-0116Secure SDLC policy · ProcessRCF-0117Secure SDLC policy · TechnicalRCF-0118Threat modeling · PolicyRCF-0119Threat modeling · ProcessRCF-0120Threat modeling · TechnicalRCF-0121Secure code review · PolicyRCF-0122Secure code review · ProcessRCF-0123Secure code review · TechnicalRCF-0124SAST/DAST · PolicyRCF-0125SAST/DAST · ProcessRCF-0126SAST/DAST · TechnicalRCF-0127Dependency/SBOM management · PolicyRCF-0128Dependency/SBOM management · ProcessRCF-0129Dependency/SBOM management · TechnicalRCF-0130CI/CD hardening · PolicyRCF-0131CI/CD hardening · ProcessRCF-0132CI/CD hardening · TechnicalRCF-0133IaC scanning · PolicyRCF-0134IaC scanning · ProcessRCF-0135IaC scanning · TechnicalRCF-0136API security · PolicyRCF-0137API security · ProcessRCF-0138API security · TechnicalRCF-0139Container security · PolicyRCF-0140Container security · ProcessRCF-0141Container security · TechnicalRCF-0142DevSecOps governance · PolicyRCF-0143DevSecOps governance · ProcessRCF-0144DevSecOps governance · TechnicalRCF-0145Configuration baselines · PolicyRCF-0146Configuration baselines · ProcessRCF-0147Configuration baselines · TechnicalRCF-0151MDM/MAM · PolicyRCF-0152MDM/MAM · ProcessRCF-0153MDM/MAM · TechnicalRCF-0160Device hardening · PolicyRCF-0161Device hardening · ProcessRCF-0162Device hardening · TechnicalRCF-0223Configuration management · PolicyRCF-0224Configuration management · ProcessRCF-0225Configuration management · TechnicalRCF-0226Baseline compliance · PolicyRCF-0227Baseline compliance · ProcessRCF-0228Baseline compliance · TechnicalRCF-0328Software supply chain (SBOM) · PolicyRCF-0329Software supply chain (SBOM) · ProcessRCF-0330Software supply chain (SBOM) · TechnicalRCF-0337CSPM posture · PolicyRCF-0338CSPM posture · ProcessRCF-0339CSPM posture · TechnicalRCF-0352SaaS security configuration · PolicyRCF-0353SaaS security configuration · ProcessRCF-0354SaaS security configuration · TechnicalRCF-0364Privacy by design · PolicyRCF-0365Privacy by design · ProcessRCF-0366Privacy by design · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.9 Configuration managementA.8.25 Secure development life cycleA.5.1 Policies for information securityA.8.29 Security testing in development and acceptanceA.8.16 Monitoring activitiesA.8.26 Application security requirementsA.8.8 Management of technical vulnerabilitiesA.8.1 User endpoint devicesA.5.9 Inventory of information and other associated assetsA.5.34 Privacy and protection of personal identifiable information (PII)A.5.21 Managing information security in the ICT supply chainA.8.27 Secure system architecture and engineering principlesA.5.36 Compliance with policies, rules and standards for information securityA.8.32 Change managementA.5.23 Information security for use of cloud servicesA.8.15 LoggingA.5.15 Access controlA.5.22 Monitoring, review and change management of supplier servicesA.8.5 Secure authenticationA.5.4 Management responsibilitiesA.8.7 Protection against malwareA.5.2 Information security roles and responsibilitiesA.6.7 Remote workingA.8.31 Separation of development, test and production environmentsA.5.8 Information security in project managementA.8.28 Secure codingA.8.4 Access to source code

ISO/IEC 42001:2023 — Annex A counterparts

A.6.2.2 AI system requirements and specificationA.6.2.4 AI system verification and validationA.6.1.2 Objectives for responsible development of AI systemA.6.1.3 Processes for responsible design and development of AI systems

Cyber Essentials counterparts

CE2.1 Remove unnecessary accounts and softwareCE2.2 Change default and guessable passwordsCE3.2 Apply critical updates within 14 daysCE3.1 Use licensed and supported softwareCE4.3 Require multi-factor authenticationCE2.3 Enforce device unlocking credentialsCE5.1 Operate a malware protection mechanismCE5.2 Restrict execution to approved software

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Device hardening baseline
The secure-configuration standard applied to devices when handed out (default settings, disabled services) and how compliance is checked.
Mobile device management configuration
The tool that manages work phones and tablets, able to enforce security rules and remotely wipe a lost device.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

DE.CM-01 Networks monitoredGV.PO-01 Cybersecurity policy establishedGV.PO-02 Cybersecurity policy maintainedGV.SC-06 Due diligence before engagementID.AM-08 Assets managed through lifecycleID.RA-01 Vulnerabilities identified and recordedID.RA-03 Threats identified and recordedPR.AA-05 Access permissions managed
Ask Sekura: “What evidence proves PR.PS-01?”
Also via MCP, free with account