SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

GV.RM-06Standardized risk method established

Use one consistent method to score, document, and rank cyber risks. A common approach lets you compare risks fairly and prioritize the right fixes.

Mapping at a glance
GV.RM-06Standardized risk method establishedNIST CSF 2.0
RCF-0010Risk treatmentGovernance & Risk · PolicyRCF-0011Risk treatmentGovernance & Risk · ProcessRCF-0012Risk treatmentGovernance & Risk · TechnicalRCF-0013Exception managementGovernance & Risk · PolicyRCF-0014Exception managementGovernance & Risk · Process

GV.RM-06 is covered by 18 Sekit CSF controls. +13 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0010Risk treatment · PolicyRCF-0011Risk treatment · ProcessRCF-0012Risk treatment · TechnicalRCF-0013Exception management · PolicyRCF-0014Exception management · ProcessRCF-0015Exception management · TechnicalRCF-0019Metrics & reporting · PolicyRCF-0020Metrics & reporting · ProcessRCF-0021Metrics & reporting · TechnicalRCF-0034Issues management · PolicyRCF-0035Issues management · ProcessRCF-0036Issues management · TechnicalRCF-0385Corrective action tracking · PolicyRCF-0386Corrective action tracking · ProcessRCF-0387Corrective action tracking · TechnicalRCF-0400Change management · PolicyRCF-0401Change management · ProcessRCF-0402Change management · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.36 Compliance with policies, rules and standards for information securityA.8.16 Monitoring activitiesA.8.9 Configuration managementA.8.32 Change managementA.5.25 Assessment and decision on information security eventsA.8.15 LoggingA.5.26 Response to information security incidentsA.5.4 Management responsibilitiesA.5.35 Independent review of information securityA.5.1 Policies for information securityA.8.8 Management of technical vulnerabilitiesA.5.24 Information security incident management planning and preparationA.5.37 Documented operating proceduresA.5.27 Learning from information security incidentsA.5.7 Threat intelligenceA.8.31 Separation of development, test and production environmentsA.5.8 Information security in project management

ISO/IEC 42001:2023 — Annex A counterparts

A.6.2.5 AI system deploymentA.8.3 External reportingA.3.3 Reporting of concernsA.6.2.3 Documentation of AI system design and development

Cyber Essentials counterparts

CE3.2 Apply critical updates within 14 days

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Risk assessment and treatment plan
The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

GV.PO-02 Cybersecurity policy maintainedGV.RM-04 Risk response strategy establishedGV.RM-05 Lines of communication for risk establishedGV.RM-07 Strategic opportunities characterizedID.IM-01 Improvements from evaluationsID.IM-02 Improvements from tests and exercisesID.IM-04 Response and recovery plans maintainedPR.PS-03 Hardware maintained
Ask Sekura: “What evidence proves GV.RM-06?”
Also via MCP, free with account