Sekit CSF · Application Security · Policy
RCF-0124SAST/DAST
Formal policy requires automated security testing of application code and running applications
Mapping at a glance
RCF-0124SAST/DASTApplication Security · Policy
A.5.1Policies for information securityISO/IEC 27001:2022 · Annex A controlsA.8.29Security testing in development and acceptanceISO/IEC 27001:2022 · Annex A controlsDE.CM-01Networks monitoredNIST CSF 2.0PR.PS-01Configuration management appliedNIST CSF 2.0PR.PS-04Logs generated for monitoringNIST CSF 2.0
RCF-0124 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsSekit's SAST/DAST policy is a topic-specific policy under A.5.1 that requires automated static and dynamic security testing of applications before each release.A.8.29Security testing in development and acceptancesupportsThis Sekit policy documents the requirement for automated static and dynamic testing before release, one of the testing methods this ISO control requires alongside review and acceptance checks.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
DE.CM-01Networks monitoredPR.PS-01Configuration management appliedPR.PS-04Logs generated for monitoring
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Application security testing evidence
The proof that code and applications are automatically scanned for flaws (SAST/DAST), including dependencies and APIs.
From the Sekit evidence catalog
This topic through the other lenses
All Application Security controls
Ask Sekura: “What evidence proves RCF-0124?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.