SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

ID.RA-01Vulnerabilities identified and recorded

Find weaknesses in your assets, confirm they are real, and record them so they can be tracked and fixed. Unrecorded vulnerabilities tend to be forgotten.

Mapping at a glance
ID.RA-01Vulnerabilities identified and recordedNIST CSF 2.0
RCF-0007Risk assessmentGovernance & Risk · PolicyRCF-0008Risk assessmentGovernance & Risk · ProcessRCF-0009Risk assessmentGovernance & Risk · TechnicalRCF-0118Threat modelingApplication Security · PolicyRCF-0119Threat modelingApplication Security · Process

ID.RA-01 is covered by 21 Sekit CSF controls. +16 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0007Risk assessment · PolicyRCF-0008Risk assessment · ProcessRCF-0009Risk assessment · TechnicalRCF-0118Threat modeling · PolicyRCF-0119Threat modeling · ProcessRCF-0120Threat modeling · TechnicalRCF-0154Patch management · PolicyRCF-0155Patch management · ProcessRCF-0156Patch management · TechnicalRCF-0217Vulnerability scanning · PolicyRCF-0218Vulnerability scanning · ProcessRCF-0219Vulnerability scanning · TechnicalRCF-0226Baseline compliance · PolicyRCF-0227Baseline compliance · ProcessRCF-0228Baseline compliance · TechnicalRCF-0232Exposure management · PolicyRCF-0233Exposure management · ProcessRCF-0234Exposure management · TechnicalRCF-0355Privacy risk assessments (DPIA) · PolicyRCF-0356Privacy risk assessments (DPIA) · ProcessRCF-0357Privacy risk assessments (DPIA) · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.8 Management of technical vulnerabilitiesA.5.1 Policies for information securityA.8.9 Configuration managementA.8.25 Secure development life cycleA.5.34 Privacy and protection of personal identifiable information (PII)A.5.7 Threat intelligenceA.8.26 Application security requirementsA.8.16 Monitoring activitiesA.5.9 Inventory of information and other associated assetsA.5.36 Compliance with policies, rules and standards for information securityA.5.37 Documented operating proceduresA.5.31 Legal, statutory, regulatory and contractual requirementsA.5.35 Independent review of information securityA.8.27 Secure system architecture and engineering principles

ISO/IEC 42001:2023 — Annex A counterparts

A.5.2 AI system impact assessment processA.6.2.2 AI system requirements and specificationA.5.4 Assessing AI system impact on individuals or groups of individualsA.5.3 Documentation of AI system impact assessments

Cyber Essentials counterparts

CE3.2 Apply critical updates within 14 daysCE2.1 Remove unnecessary accounts and softwareCE2.2 Change default and guessable passwordsCE1.3 Block unauthenticated inbound trafficCE3.1 Use licensed and supported softwareCE1.2 Protect the administrative interface

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Patch management report
The proof that security updates are applied on time across devices and systems, with tracking of what is still outstanding.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

GV.RM-01 Risk management objectives establishedGV.RM-02 Risk appetite and tolerance establishedGV.RM-03 Cyber risk in enterprise risk managementID.RA-02 Threat intelligence receivedID.RA-03 Threats identified and recordedID.RA-05 Inherent risk understoodID.RA-07 Changes and exceptions managedPR.PS-01 Configuration management applied
Ask Sekura: “What evidence proves ID.RA-01?”
Also via MCP, free with account