SekitCrosswalk
ENES
Start now
Sekit CSF · Family

Application Security

30 controls in 10 topics, each seen through the policy, process and technical lenses.

Policy

RCF-0136API security5 mappingsSecurity requirements for all application programming interfaces are formally defined and documentedRCF-0130CI/CD hardening6 mappingsSecurity controls in the software build and deployment pipeline are formally defined and requiredRCF-0139Container security7 mappingsSecurity standards for building and running containerised applications are formally definedRCF-0127Dependency/SBOM management8 mappingsThe company formally tracks all software components and third-party libraries used in its applicationsRCF-0142DevSecOps governance5 mappingsAccountability for security within development and operations teams is formally definedRCF-0133IaC scanning6 mappingsSecurity scanning of infrastructure-as-code templates is formally required before deploymentRCF-0124SAST/DAST6 mappingsFormal policy requires automated security testing of application code and running applicationsRCF-0121Secure code review5 mappingsSecurity review of code is formally required before it is released to productionRCF-0115Secure SDLC policy7 mappingsSecurity requirements are formally integrated into the software development lifecycle from planning to releaseRCF-0118Threat modeling7 mappingsThe company formally identifies and documents potential threats to applications before development begins

Process

RCF-0137API security6 mappingsAPIs are consistently designed, tested and monitored to meet security requirementsRCF-0131CI/CD hardening5 mappingsPipeline security controls are consistently applied and reviewed for every build and deploymentRCF-0140Container security8 mappingsContainer images and configurations are consistently reviewed against security standardsRCF-0128Dependency/SBOM management7 mappingsSoftware bills of materials are consistently maintained and reviewed for known vulnerabilitiesRCF-0143DevSecOps governance5 mappingsSecurity is consistently embedded into development team practices and sprint cyclesRCF-0134IaC scanning5 mappingsInfrastructure templates are consistently scanned for misconfigurations before being appliedRCF-0125SAST/DAST6 mappingsStatic and dynamic security tests are consistently run as part of the build and release processRCF-0122Secure code review4 mappingsCode reviews consistently include security checks performed by trained developersRCF-0116Secure SDLC policy7 mappingsSecurity activities are consistently applied at each stage of the development processRCF-0119Threat modeling6 mappingsThreat modeling is consistently conducted for new features and significant changes

Technical

RCF-0138API security6 mappingsTechnical controls enforce authentication, authorisation and rate limiting on all API endpointsRCF-0132CI/CD hardening6 mappingsTechnical controls protect the build pipeline from tampering and enforce security gates at each stageRCF-0141Container security9 mappingsTechnical tools scan container images and enforce runtime security policies automaticallyRCF-0129Dependency/SBOM management6 mappingsTechnical tools automatically identify vulnerable dependencies and alert or block affected buildsRCF-0144DevSecOps governance5 mappingsTechnical dashboards provide visibility of security posture across all development pipelinesRCF-0135IaC scanning5 mappingsAutomated tools scan infrastructure code for security issues and block deployment of non-compliant templatesRCF-0126SAST/DAST5 mappingsAutomated SAST and DAST tools integrate into the pipeline and block releases with critical findingsRCF-0123Secure code review4 mappingsAutomated tools scan code for security vulnerabilities as part of the development workflowRCF-0117Secure SDLC policy6 mappingsTechnical gates enforce security checks before code can progress through the development pipelineRCF-0120Threat modeling5 mappingsTechnical tools support structured threat modeling and track identified risks to resolution

This family in ISO/IEC 27001:2022

Every framework item the family's controls map to, most-connected first — grouped by Sekit CSF family, never by the framework's own index.

A.8.25 Secure development life cycleA.8.29 Security testing in development and acceptanceA.5.1 Policies for information securityA.8.9 Configuration managementA.8.26 Application security requirementsA.8.8 Management of technical vulnerabilitiesA.8.16 Monitoring activitiesA.5.9 Inventory of information and other associated assetsA.8.32 Change managementA.8.15 LoggingA.5.15 Access controlA.5.4 Management responsibilitiesA.8.5 Secure authenticationA.8.7 Protection against malwareA.5.2 Information security roles and responsibilitiesA.8.31 Separation of development, test and production environmentsA.8.27 Secure system architecture and engineering principlesA.5.8 Information security in project managementA.8.4 Access to source codeA.8.28 Secure coding

This family in NIST CSF 2.0

PR.PS-01 Configuration management appliedPR.PS-04 Logs generated for monitoringPR.PS-03 Hardware maintainedPR.AA-05 Access permissions managedPR.PS-02 Software maintainedDE.CM-01 Networks monitoredGV.SC-06 Due diligence before engagementID.RA-01 Vulnerabilities identified and recordedID.AM-08 Assets managed through lifecycleGV.PO-01 Cybersecurity policy establishedID.RA-03 Threats identified and recorded

This family in ISO/IEC 42001:2023 — Annex A

A.6.2.2 AI system requirements and specificationA.6.2.4 AI system verification and validationA.6.1.2 Objectives for responsible development of AI systemA.6.1.3 Processes for responsible design and development of AI systems

This family in Cyber Essentials

CE3.2 Apply critical updates within 14 daysCE3.1 Use licensed and supported softwareCE2.1 Remove unnecessary accounts and softwareCE5.1 Operate a malware protection mechanismCE5.2 Restrict execution to approved software
Ask Sekura: “What evidence proves Application Security?”
Also via MCP, free with account