SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

GV.RM-05Lines of communication for risk established

Set up clear channels for raising and discussing cyber risks across the organization, including risks introduced by suppliers and third parties. Risks should surface fast, not stay siloed.

Mapping at a glance
GV.RM-05Lines of communication for risk establishedNIST CSF 2.0
RCF-0010Risk treatmentGovernance & Risk · PolicyRCF-0011Risk treatmentGovernance & Risk · ProcessRCF-0012Risk treatmentGovernance & Risk · TechnicalRCF-0019Metrics & reportingGovernance & Risk · PolicyRCF-0020Metrics & reportingGovernance & Risk · Process

GV.RM-05 is covered by 21 Sekit CSF controls. +16 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0010Risk treatment · PolicyRCF-0011Risk treatment · ProcessRCF-0012Risk treatment · TechnicalRCF-0019Metrics & reporting · PolicyRCF-0020Metrics & reporting · ProcessRCF-0021Metrics & reporting · TechnicalRCF-0022Internal audit · PolicyRCF-0023Internal audit · ProcessRCF-0024Internal audit · TechnicalRCF-0031Control testing program · PolicyRCF-0032Control testing program · ProcessRCF-0033Control testing program · TechnicalRCF-0373Control evidence management · PolicyRCF-0374Control evidence management · ProcessRCF-0375Control evidence management · TechnicalRCF-0376Compliance calendar · PolicyRCF-0377Compliance calendar · ProcessRCF-0378Compliance calendar · TechnicalRCF-0382Audit readiness · PolicyRCF-0383Audit readiness · ProcessRCF-0384Audit readiness · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.36 Compliance with policies, rules and standards for information securityA.5.35 Independent review of information securityA.8.15 LoggingA.5.33 Protection of recordsA.5.31 Legal, statutory, regulatory and contractual requirementsA.8.16 Monitoring activitiesA.8.8 Management of technical vulnerabilitiesA.8.29 Security testing in development and acceptanceA.5.27 Learning from information security incidentsA.8.9 Configuration managementA.5.26 Response to information security incidentsA.5.4 Management responsibilitiesA.5.7 Threat intelligenceA.5.28 Collection of evidenceA.5.8 Information security in project managementA.8.34 Protection of information systems during audit testing

ISO/IEC 42001:2023 — Annex A counterparts

A.6.2.4 AI system verification and validationA.5.3 Documentation of AI system impact assessmentsA.6.2.3 Documentation of AI system design and developmentA.8.3 External reportingA.6.2.7 AI system technical documentationA.8.2 System documentation and information for users

Cyber Essentials counterparts

CE3.2 Apply critical updates within 14 days

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Risk assessment and treatment plan
The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.
Security metrics report
The report or dashboard the company uses to measure how its security is doing (e.g. incidents, pending patches, training completion) and present it to leadership.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

GV.OC-01 Organizational mission understoodGV.OC-05 Dependencies understoodGV.RM-04 Risk response strategy establishedGV.RM-06 Standardized risk method establishedGV.RM-07 Strategic opportunities characterizedID.IM-01 Improvements from evaluationsID.IM-02 Improvements from tests and exercisesID.IM-03 Improvements from operations
Ask Sekura: “What evidence proves GV.RM-05?”
Also via MCP, free with account