Sekit CSF · Application Security · Policy
RCF-0130CI/CD hardening
Security controls in the software build and deployment pipeline are formally defined and required
Mapping at a glance
RCF-0130CI/CD hardeningApplication Security · Policy
RCF-0130 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsSekit's CI/CD hardening policy is part of A.5.1's topic-specific policy layer: it sets written security requirements for the build and deployment pipeline, treating it as a production system in its own right.A.8.9Configuration managementsupportsWritten security requirements for the build and deployment pipeline treat it as a production system, extending A.8.9's configuration discipline to the pipeline itself.A.8.25Secure development life cyclesupportsThis policy facet sets written security requirements for the build and deployment pipeline itself, treating it as a production system A.8.25 must protect.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
PR.PS-01Configuration management appliedPR.PS-03Hardware maintainedPR.PS-04Logs generated for monitoring
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
CI/CD pipeline security
The security controls in the automated build-and-deploy process, including containers and infrastructure-as-code.
From the Sekit evidence catalog
This topic through the other lenses
All Application Security controls
Ask Sekura: “What evidence proves RCF-0130?”
Also via MCP, free with account