Sekit CSF · Governance & Risk · Technical
RCF-0006Roles & responsibilities
Systems enforce role-based security responsibilities
Mapping at a glance
RCF-0006Roles & responsibilitiesGovernance & Risk · Technical
A.5.3Segregation of dutiesISO/IEC 27001:2022 · Annex A controlsA.5.15Access controlISO/IEC 27001:2022 · Annex A controlsA.8.2Privileged access rightsISO/IEC 27001:2022 · Annex A controlsGV.RR-01Leadership accountability for cyber riskNIST CSF 2.0GV.RR-02Roles and responsibilities establishedNIST CSF 2.0
RCF-0006 maps to 8 controls across the published frameworks. +3 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.3Segregation of dutiessupportsConfiguring system permissions so each security responsibility can only be exercised by the people formally assigned to it supports segregation of duties, but role-based permissions alone do not stop one role from both requesting and approving the same change.A.5.15Access controlsupportsConfiguring systems so each defined responsibility can only be exercised by the assigned person is access control applied to governance roles, backing A.5.15's requirement that access maps to genuine need.A.8.2Privileged access rightsenablesConfiguring system permissions so each security responsibility can only be exercised by the assigned person is the technical precondition that makes A.8.2's privilege restriction enforceable rather than aspirational.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.RR-01Leadership accountability for cyber riskGV.RR-02Roles and responsibilities establishedGV.RR-03Resources allocated for cybersecurityGV.RR-04Cybersecurity in human resources
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Security roles and responsibilities
The document or chart showing who owns each aspect of security in the company (e.g. a security org chart or a RACI matrix).
From the Sekit evidence catalog
This topic through the other lenses
All Governance & Risk controls
Ask Sekura: “What evidence proves RCF-0006?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.