Sekit CSF · Asset Management · Policy
RCF-0040Software inventory
All software installed or used within the company is formally required to be recorded and licensed
Mapping at a glance
RCF-0040Software inventoryAsset Management · Policy
A.5.9Inventory of information and other associated assetsISO/IEC 27001:2022 · Annex A controlsA.5.32Intellectual property rightsISO/IEC 27001:2022 · Annex A controlsID.AM-02Software inventory maintainedNIST CSF 2.0ID.AM-05Assets prioritized by criticalityNIST CSF 2.0A.4.4Tooling resourcesISO/IEC 42001:2023 — Annex A
RCF-0040 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.9Inventory of information and other associated assetssupportsThis policy control requires all software and SaaS in business use to be recorded and licensed, covering the software slice of A.5.9's asset inventory.A.5.32Intellectual property rightssupportsThe software inventory policy facet requires every tool in use to be recorded, licensed, and approved before adoption, the written commitment A.5.32 needs to prevent unlicensed use.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Software and SaaS inventory
The list of installed software and cloud apps the company uses, with their licences, and a sense of which tools people use that are not officially approved.
From the Sekit evidence catalog
This topic through the other lenses
All Asset Management controls
Ask Sekura: “What evidence proves RCF-0040?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.