Sekit CSF · Governance & Risk · Process

RCF-0002Policy management

Security policies are consistently communicated and followed across the organisation

Mapping at a glance

RCF-0002Policy managementGovernance & Risk · Process

A.5.1Policies for information securityISO/IEC 27001:2022 · Annex A controls A.5.4Management responsibilitiesISO/IEC 27001:2022 · Annex A controls A.5.36Compliance with policies, rules and standards for information securityISO/IEC 27001:2022 · Annex A controls GV.PO-01Cybersecurity policy establishedNIST CSF 2.0 GV.PO-02Cybersecurity policy maintainedNIST CSF 2.0

RCF-0002 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →

Maps to ISO/IEC 27001:2022 · Annex A controls

Curated mapping with the reasoning, not just the codes.

A.5.1Policies for information securitysupportsRunning a recurring routine that puts security policies in front of every employee and checks they are followed makes A.5.1's communication requirement work day to day rather than sit unread in a folder.A.5.4Management responsibilitiessupportsThis process control runs the recurring routine that puts the policy in front of every employee, giving managers the operational engine A.5.4 needs to enforce it consistently.A.5.36Compliance with policies, rules and standards for information securitysupportsThis process control runs a recurring routine that puts security policies in front of every employee and verifies they are followed, the operational check A.5.36 requires.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

GV.PO-01Cybersecurity policy established GV.PO-02Cybersecurity policy maintained

Maps to ISO/IEC 42001:2023 — Annex A

Curated mapping with the reasoning, not just the codes.

A.2.4Review of the AI policysupportsRCF-0002 runs the recurring routine that communicates and verifies security policy adherence; A.2.4 needs that cadence applied to the AI policy specifically, including AI-triggered off-cycle reviews the general routine does not anticipate.

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Information security policy

The written, leadership-approved document that sets the company's security rules: what is protected, how, and who is responsible.

From the Sekit evidence catalog

This topic through the other lenses

All Governance & Risk controls

Ask Sekura: “What evidence proves RCF-0002?”

Connect your AI · free MCP

https://sekit.ai/api/mcp/crosswalk

In Claude or ChatGPT, add a custom connector and paste this URL.
Sign in with your email to finish. Free, read-only, no organization required.