Sekit CSF · Vulnerability & Configuration · Policy

RCF-0235Penetration testing

The company formally commissions periodic penetration tests to identify exploitable weaknesses

Mapping at a glance

RCF-0235Penetration testingVulnerability & Configuration · Policy

A.5.1Policies for information securityISO/IEC 27001:2022 A.8.8Management of technical vulnerabilitiesISO/IEC 27001:2022 ID.RA-05Inherent risk understoodNIST CSF 2.0 ID.RA-06Risk responses chosen and trackedNIST CSF 2.0

RCF-0235 maps to 4 controls across the published frameworks. Open in the full graph →

Maps to ISO/IEC 27001:2022

Curated mapping with the reasoning, not just the codes.

A.5.1Policies for information securitysupportsSekit's Penetration testing policy is part of A.5.1's topic-specific policy layer: it commits to commissioning an independent test at a defined interval and after any major change.A.8.8Management of technical vulnerabilitiessupportsThis policy facet commits to an independent penetration test at a defined interval and after major changes, the adversarial-validation leg A.8.8 expects.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

ID.RA-05Inherent risk understood ID.RA-06Risk responses chosen and tracked

This topic through the other lenses

All Vulnerability & Configuration controls

Ask Sekura: “What evidence proves RCF-0235?”

Also via MCP, free with account