Sekit CSF · Governance & Risk · Process
RCF-0011Risk treatment
Risk treatment actions are tracked and completed within agreed timelines
Mapping at a glance
RCF-0011Risk treatmentGovernance & Risk · Process
A.5.26Response to information security incidentsISO/IEC 27001:2022A.5.36Compliance with policies, rules and standards for information securityISO/IEC 27001:2022GV.RM-04Risk response strategy establishedNIST CSF 2.0GV.RM-05Lines of communication for risk establishedNIST CSF 2.0GV.RM-06Standardized risk method establishedNIST CSF 2.0
RCF-0011 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.26Response to information security incidentsrelatedTracking agreed risk actions to completion is a general governance discipline that also applies to the corrective actions a response generates, though its main scope is risk treatment, not incident response.A.5.36Compliance with policies, rules and standards for information securitysupportsThis process control tracks agreed risk actions to completion within their deadlines, the follow-through A.5.36 expects after a treatment decision is made.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.RM-04Risk response strategy establishedGV.RM-05Lines of communication for risk establishedGV.RM-06Standardized risk method establishedGV.RM-07Strategic opportunities characterized
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Risk assessment and treatment plan
The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.
From the Sekit evidence catalog
This topic through the other lenses
All Governance & Risk controls
Ask Sekura: “What evidence proves RCF-0011?”
Also via MCP, free with account