Sekit CSF · Governance & Risk · Policy
RCF-0013Exception management
Exceptions to security policies are formally documented and approved
Mapping at a glance
RCF-0013Exception managementGovernance & Risk · Policy
RCF-0013 maps to 4 controls across the published frameworks. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsSekit's Exception management policy, one of A.5.1's topic-specific policies, spells out how staff request, get approval for, and time-limit any deviation from the rules.A.5.36Compliance with policies, rules and standards for information securityenablesThis policy control defines in writing how deviations from security policy are requested, approved and time-limited, the exception path A.5.36's compliance checking must account for.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Information security policy
The written, leadership-approved document that sets the company's security rules: what is protected, how, and who is responsible.
From the Sekit evidence catalog
This topic through the other lenses
All Governance & Risk controls
Ask Sekura: “What evidence proves RCF-0013?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.