SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

ID.RA-05Inherent risk understood

Combine threats, vulnerabilities, likelihood, and impact to understand your underlying risk and decide what to tackle first.

Mapping at a glance
ID.RA-05Inherent risk understoodNIST CSF 2.0
RCF-0217Vulnerability scanningVulnerability & Configuration · PolicyRCF-0218Vulnerability scanningVulnerability & Configuration · ProcessRCF-0219Vulnerability scanningVulnerability & Configuration · TechnicalRCF-0220Vulnerability remediation SLAsVulnerability & Configuration · PolicyRCF-0221Vulnerability remediation SLAsVulnerability & Configuration · Process

ID.RA-05 is covered by 18 Sekit CSF controls. +13 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0217Vulnerability scanning · PolicyRCF-0218Vulnerability scanning · ProcessRCF-0219Vulnerability scanning · TechnicalRCF-0220Vulnerability remediation SLAs · PolicyRCF-0221Vulnerability remediation SLAs · ProcessRCF-0222Vulnerability remediation SLAs · TechnicalRCF-0229Patch prioritization · PolicyRCF-0230Patch prioritization · ProcessRCF-0231Patch prioritization · TechnicalRCF-0232Exposure management · PolicyRCF-0233Exposure management · ProcessRCF-0234Exposure management · TechnicalRCF-0235Penetration testing · PolicyRCF-0236Penetration testing · ProcessRCF-0237Penetration testing · TechnicalRCF-0424Patch/compensating controls (ICS) · PolicyRCF-0425Patch/compensating controls (ICS) · ProcessRCF-0426Patch/compensating controls (ICS) · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.8 Management of technical vulnerabilitiesA.5.1 Policies for information securityA.5.37 Documented operating proceduresA.8.16 Monitoring activitiesA.8.34 Protection of information systems during audit testingA.8.9 Configuration managementA.5.9 Inventory of information and other associated assetsA.5.7 Threat intelligenceA.8.31 Separation of development, test and production environments

Cyber Essentials counterparts

CE3.2 Apply critical updates within 14 daysCE1.3 Block unauthenticated inbound trafficCE1.2 Protect the administrative interfaceCE5.2 Restrict execution to approved software

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Risk assessment and treatment plan
The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

ID.IM-02 Improvements from tests and exercisesID.RA-01 Vulnerabilities identified and recordedID.RA-06 Risk responses chosen and trackedID.RA-07 Changes and exceptions managedPR.PS-02 Software maintained
Ask Sekura: “What evidence proves ID.RA-05?”
Also via MCP, free with account