Sekit CSF · Secure Operations · Process
RCF-0401Change management
Changes are consistently submitted, reviewed and approved through the change management process
Mapping at a glance
RCF-0401Change managementSecure Operations · Process
A.8.31Separation of development, test and production environmentsISO/IEC 27001:2022 · Annex A controlsA.8.32Change managementISO/IEC 27001:2022 · Annex A controlsGV.RM-06Standardized risk method establishedNIST CSF 2.0PR.PS-03Hardware maintainedNIST CSF 2.0A.6.2.3Documentation of AI system design and developmentISO/IEC 42001:2023 — Annex A
RCF-0401 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.8.31Separation of development, test and production environmentssupportsThis Sekit process control routes every production change through submission, review and approval with a record kept, the controlled boundary this ISO control requires between environments.A.8.32Change managementsupportsThe Sekit process control routes every production change through submission, review and approval with a record kept, carrying out in practice the change control this ISO control requires.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
A.6.2.3Documentation of AI system design and developmentsupportsRouting production changes through review and approval produces the trigger point where AI documentation should be updated, though the change record alone does not update the design documentation.A.6.2.5AI system deploymentsupportsRouting every change through submission, review and approval in practice is the process AI deployments should follow, applied generally rather than to AI releases specifically.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Change and release management records
The process to review and approve changes to production systems before applying them, and how new versions are released in a controlled way.
From the Sekit evidence catalog
This topic through the other lenses
All Secure Operations controls
Ask Sekura: “What evidence proves RCF-0401?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.