SekitCrosswalk
ENES
Start now
Sekit CSF · Governance & Risk · Policy

RCF-0022Internal audit

The company conducts formal internal audits of its security controls

Mapping at a glance
RCF-0022Internal auditGovernance & Risk · Policy
A.5.35Independent review of information securityISO/IEC 27001:2022GV.RM-05Lines of communication for risk establishedNIST CSF 2.0ID.IM-03Improvements from operationsNIST CSF 2.0ID.IM-04Response and recovery plans maintainedNIST CSF 2.0

RCF-0022 maps to 4 controls across the published frameworks. Open in the full graph →

Maps to ISO/IEC 27001:2022

Curated mapping with the reasoning, not just the codes.

A.5.35Independent review of information securitysupportsA documented internal audit approach defining what gets checked, how often and by whom sets up this control's independence and cadence expectations, but a written approach alone does not perform the review itself.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

GV.RM-05Lines of communication for risk establishedID.IM-03Improvements from operationsID.IM-04Response and recovery plans maintained

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Internal audit report
The output of the internal reviews the company runs on its own security controls, with findings and improvement actions.
From the Sekit evidence catalog

This topic through the other lenses

RCF-0023 ProcessRCF-0024 Technical

All Governance & Risk controls

Governance & Risk
Ask Sekura: “What evidence proves RCF-0022?”
Also via MCP, free with account