Sekit CSF · Application Security · Process
RCF-0119Threat modeling
Threat modeling is consistently conducted for new features and significant changes
Mapping at a glance
RCF-0119Threat modelingApplication Security · Process
A.8.25Secure development life cycleISO/IEC 27001:2022 · Annex A controlsA.8.26Application security requirementsISO/IEC 27001:2022 · Annex A controlsID.RA-01Vulnerabilities identified and recordedNIST CSF 2.0ID.RA-03Threats identified and recordedNIST CSF 2.0PR.PS-01Configuration management appliedNIST CSF 2.0
RCF-0119 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.8.25Secure development life cyclesupportsThe threat-modeling process facet runs a threat-identification session for each qualifying change and records what was found and decided.A.8.26Application security requirementssupportsThe process facet runs a threat-identification session per qualifying change and records the threats found, turning A.8.26's requirement-setting into a repeatable practice.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
ID.RA-01Vulnerabilities identified and recordedID.RA-03Threats identified and recordedPR.PS-01Configuration management applied
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Secure development policy
The rules the development team follows to build software securely: security requirements, code review and threat modeling.
From the Sekit evidence catalog
This topic through the other lenses
All Application Security controls
Ask Sekura: “What evidence proves RCF-0119?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.