Sekit CSF · Data Security · Policy

RCF-0106Data minimization

Digital assets and sensitive data are formally inventoried and tracked

Mapping at a glance

RCF-0106Data minimizationData Security · Policy

A.5.9Inventory of information and other associated assetsISO/IEC 27001:2022 · Annex A controls PR.DS-01Data-at-rest protectedNIST CSF 2.0 PR.DS-10Data-in-use protectedNIST CSF 2.0 A.7.2Data for development and enhancement of AI systemISO/IEC 42001:2023 — Annex A

RCF-0106 maps to 4 controls across the published frameworks. Open in the full graph →

Maps to ISO/IEC 27001:2022 · Annex A controls

Curated mapping with the reasoning, not just the codes.

A.5.9Inventory of information and other associated assetsrelatedThis policy control commits to collecting and keeping only the personal data needed, a data-minimisation objective distinct from but backed by the same inventory A.5.9 requires.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

PR.DS-01Data-at-rest protected PR.DS-10Data-in-use protected

Maps to ISO/IEC 42001:2023 — Annex A

Curated mapping with the reasoning, not just the codes.

A.7.2Data for development and enhancement of AI systemsupportsRCF-0106 commits to holding only the personal data the company needs, which should limit what ends up in a training set, but the policy predates AI and never addresses tuning or fine-tuning use.

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Data inventory and classification

The record of the personal and sensitive data the company holds, where it lives and how it is classified by sensitivity.

From the Sekit evidence catalog

This topic through the other lenses

All Data Security controls

Ask Sekura: “What evidence proves RCF-0106?”

Connect your AI · free MCP

https://sekit.ai/api/mcp/crosswalk

In Claude or ChatGPT, add a custom connector and paste this URL.
Sign in with your email to finish. Free, read-only, no organization required.