Sekit CSF · Cloud Security · Policy
RCF-0352SaaS security configuration
Security configuration requirements for all software-as-a-service applications are formally defined
Mapping at a glance
RCF-0352SaaS security configurationCloud Security · Policy
A.5.23Information security for use of cloud servicesISO/IEC 27001:2022 · Annex A controlsA.8.9Configuration managementISO/IEC 27001:2022 · Annex A controlsPR.PS-01Configuration management appliedNIST CSF 2.0PR.PS-02Software maintainedNIST CSF 2.0CE2.2Change default and guessable passwordsCyber Essentials
RCF-0352 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.23Information security for use of cloud servicessupportsThe SaaS security configuration policy facet defines mandatory settings such as MFA and restricted sharing for every SaaS app, covering the SaaS side of A.5.23.A.8.9Configuration managementsupportsDefining the security settings every SaaS application must have, MFA, sharing defaults, admin limits, is A.8.9's configuration baseline extended to SaaS tools.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Software and SaaS inventory
The list of installed software and cloud apps the company uses, with their licences, and a sense of which tools people use that are not officially approved.
From the Sekit evidence catalog
This topic through the other lenses
All Cloud Security controls
Ask Sekura: “What evidence proves RCF-0352?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.