Sekit CSF · Governance & Risk · Process
RCF-0023Internal audit
Internal audit findings are tracked and remediated within agreed timelines
Mapping at a glance
RCF-0023Internal auditGovernance & Risk · Process
A.5.27Learning from information security incidentsISO/IEC 27001:2022A.5.35Independent review of information securityISO/IEC 27001:2022A.5.36Compliance with policies, rules and standards for information securityISO/IEC 27001:2022GV.RM-05Lines of communication for risk establishedNIST CSF 2.0ID.IM-03Improvements from operationsNIST CSF 2.0
RCF-0023 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.27Learning from information security incidentsrelatedTracking audit findings to closure is the same discipline applied to a different source of gaps, audits rather than incidents, but it reinforces the closure habit this control depends on.A.5.35Independent review of information securitysupportsTracking every audit finding to closure with escalation for overdue items supports this control by closing the loop after a review, though the review itself must still be independent and at planned intervals.A.5.36Compliance with policies, rules and standards for information securitysupportsThis process control tracks every audit finding to closure within its agreed deadline, escalating overdue items to leadership, the exact compliance-checking activity A.5.36 requires.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.RM-05Lines of communication for risk establishedID.IM-03Improvements from operationsID.IM-04Response and recovery plans maintained
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Internal audit report
The output of the internal reviews the company runs on its own security controls, with findings and improvement actions.
From the Sekit evidence catalog
This topic through the other lenses
All Governance & Risk controls
Ask Sekura: “What evidence proves RCF-0023?”
Also via MCP, free with account