Sekit CSF · Supply Chain Security · Policy
RCF-0328Software supply chain (SBOM)
The company formally tracks the software components it uses to manage risks from third-party code
Mapping at a glance
RCF-0328Software supply chain (SBOM)Supply Chain Security · Policy
A.5.9Inventory of information and other associated assetsISO/IEC 27001:2022A.5.21Managing information security in the ICT supply chainISO/IEC 27001:2022GV.SC-06Due diligence before engagementNIST CSF 2.0ID.AM-08Assets managed through lifecycleNIST CSF 2.0PR.PS-01Configuration management appliedNIST CSF 2.0
RCF-0328 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.9Inventory of information and other associated assetssupportsThis policy control states that software components the company depends on are inventoried to manage third-party risk, matching A.5.9's asset inventory scope.A.5.21Managing information security in the ICT supply chainsupportsInventorying the software components the company builds with or depends on, and managing their third-party risk, supports A.5.21's ICT supply chain requirement, which also extends to services, hardware and suppliers' own sub-processors.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.SC-06Due diligence before engagementID.AM-08Assets managed through lifecyclePR.PS-01Configuration management applied
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Application security testing evidence
The proof that code and applications are automatically scanned for flaws (SAST/DAST), including dependencies and APIs.
From the Sekit evidence catalog
This topic through the other lenses
All Supply Chain Security controls
Ask Sekura: “What evidence proves RCF-0328?”
Also via MCP, free with account