Sekit CSF · Application Security · Policy
RCF-0133IaC scanning
Security scanning of infrastructure-as-code templates is formally required before deployment
Mapping at a glance
RCF-0133IaC scanningApplication Security · Policy
RCF-0133 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsSekit's IaC scanning policy, one of the topic-specific policies A.5.1 expects, requires infrastructure-as-code templates to pass a security scan before they are deployed.A.8.9Configuration managementsupportsRequiring infrastructure-as-code templates to pass a security scan before deployment prevents misconfiguration before it reaches the environment A.8.9 is meant to protect.A.8.25Secure development life cyclesupportsThis policy facet requires infrastructure-as-code templates to pass a security scan before deployment, extending A.8.25's lifecycle discipline to infrastructure definitions.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
PR.PS-01Configuration management appliedPR.PS-03Hardware maintainedPR.PS-04Logs generated for monitoring
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
CI/CD pipeline security
The security controls in the automated build-and-deploy process, including containers and infrastructure-as-code.
From the Sekit evidence catalog
This topic through the other lenses
All Application Security controls
Ask Sekura: “What evidence proves RCF-0133?”
Also via MCP, free with account