Sekit CSF · Asset Management · Process

RCF-0041Software inventory

Software assets are consistently tracked, licensed and removed when no longer needed

Mapping at a glance

RCF-0041Software inventoryAsset Management · Process

A.5.9Inventory of information and other associated assetsISO/IEC 27001:2022 A.5.32Intellectual property rightsISO/IEC 27001:2022 A.8.19Installation of software on operational systemsISO/IEC 27001:2022 ID.AM-02Software inventory maintainedNIST CSF 2.0 ID.AM-05Assets prioritized by criticalityNIST CSF 2.0

RCF-0041 maps to 8 controls across the published frameworks. +3 more in the table below. Open in the full graph →

Maps to ISO/IEC 27001:2022

Curated mapping with the reasoning, not just the codes.

A.5.9Inventory of information and other associated assetssupportsThis process control maintains a live register of installed software and SaaS with licence status and owner, the ongoing upkeep A.5.9 expects.A.5.32Intellectual property rightssupportsThe process facet keeps that register live, tracking licence status and removing tools once they lapse, so A.5.32's licensing obligations hold up past the initial rollout.A.8.19Installation of software on operational systemssupportsA live register of installed software and SaaS with an owner per entry gives A.8.19 the visibility needed to control what runs on operational systems.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

ID.AM-02Software inventory maintained ID.AM-05Assets prioritized by criticality

Maps to ISO/IEC 42001:2023 — Annex A

Curated mapping with the reasoning, not just the codes.

A.4.4Tooling resourcessupportsRCF-0041 keeps the software register live and removes what is no longer needed; it supports A.4.4 by giving AI tools the same tracked lifecycle, though it does not flag an AI tool adopted outside the approval process on its own.

Maps to Cyber Essentials

Curated mapping with the reasoning, not just the codes.

CE2.1Remove unnecessary accounts and software CE3.1Use licensed and supported software

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Software and SaaS inventory

The list of installed software and cloud apps the company uses, with their licences, and a sense of which tools people use that are not officially approved.

From the Sekit evidence catalog

This topic through the other lenses

All Asset Management controls

Ask Sekura: “What evidence proves RCF-0041?”

Also via MCP, free with account