Sekit CSF · Application Security · Policy
RCF-0121Secure code review
Security review of code is formally required before it is released to production
Mapping at a glance
RCF-0121Secure code reviewApplication Security · Policy
RCF-0121 maps to 5 controls across the published frameworks. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsAmong A.5.1's topic-specific policies, Sekit's Secure code review policy requires a security-focused review of every code change before it reaches production.A.8.25Secure development life cyclesupportsThis policy facet requires a security-focused review on every code change before release, one of the concrete practices A.8.25 expects.A.8.29Security testing in development and acceptancesupportsThe Sekit policy requires a security-focused review before release, one of the testing activities this ISO control requires during development and before acceptance.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Secure development policy
The rules the development team follows to build software securely: security requirements, code review and threat modeling.
From the Sekit evidence catalog
This topic through the other lenses
All Application Security controls
Ask Sekura: “What evidence proves RCF-0121?”
Also via MCP, free with account