Sekit CSF · Vulnerability & Configuration · Policy
RCF-0220Vulnerability remediation SLAs
The company formally defines how quickly vulnerabilities must be remediated based on their severity
Mapping at a glance
RCF-0220Vulnerability remediation SLAsVulnerability & Configuration · Policy
A.5.1Policies for information securityISO/IEC 27001:2022 · Annex A controlsA.8.8Management of technical vulnerabilitiesISO/IEC 27001:2022 · Annex A controlsID.IM-02Improvements from tests and exercisesNIST CSF 2.0ID.RA-05Inherent risk understoodNIST CSF 2.0ID.RA-07Changes and exceptions managedNIST CSF 2.0
RCF-0220 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsSekit's Vulnerability remediation SLA policy is part of A.5.1's topic-specific policy layer: it sets deadlines for fixing vulnerabilities by severity, from days for critical issues to weeks for minor ones.A.8.8Management of technical vulnerabilitiessupportsThis policy facet defines remediation deadlines by severity, the SLA table A.8.8 expects organizations to hold themselves to.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
ID.IM-02Improvements from tests and exercisesID.RA-05Inherent risk understoodID.RA-07Changes and exceptions managed
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Patch management report
The proof that security updates are applied on time across devices and systems, with tracking of what is still outstanding.
From the Sekit evidence catalog
This topic through the other lenses
All Vulnerability & Configuration controls
Ask Sekura: “What evidence proves RCF-0220?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.