Sekit CSF · Governance & Risk · Policy

RCF-0001Policy management

The company has a formal written security policy approved by leadership

Mapping at a glance

RCF-0001Policy managementGovernance & Risk · Policy

A.5.1Policies for information securityISO/IEC 27001:2022 GV.PO-01Cybersecurity policy establishedNIST CSF 2.0 GV.PO-02Cybersecurity policy maintainedNIST CSF 2.0 A.2.2AI policyISO/IEC 42001:2023 — Annex A

RCF-0001 maps to 4 controls across the published frameworks. Open in the full graph →

Maps to ISO/IEC 27001:2022

Curated mapping with the reasoning, not just the codes.

A.5.1Policies for information securitysupportsSekit's Policy management control produces the leadership-approved written security policy naming an owner, scope and review cycle, one piece of A.5.1's full requirement alongside the topic-specific policies and communication step mapped separately here.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

GV.PO-01Cybersecurity policy established GV.PO-02Cybersecurity policy maintained

Maps to ISO/IEC 42001:2023 — Annex A

Curated mapping with the reasoning, not just the codes.

A.2.2AI policysupportsRCF-0001 requires a leadership-approved written security policy with an owner and review cycle; A.2.2 needs that same governance discipline applied to a policy naming AI-specific principles and prohibited uses, which the general policy does not cover.

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Information security policy

The written, leadership-approved document that sets the company's security rules: what is protected, how, and who is responsible.

From the Sekit evidence catalog

This topic through the other lenses

All Governance & Risk controls

Ask Sekura: “What evidence proves RCF-0001?”

Also via MCP, free with account