NIST CSF 2.0 · derived mapping target
ID.RA-06Risk responses chosen and tracked
Choose, prioritize, plan, and track your responses to each significant risk, and communicate them. A decided-but-untracked fix rarely gets done.
Mapping at a glance
ID.RA-06Risk responses chosen and trackedNIST CSF 2.0
ID.RA-06 is covered by 3 Sekit CSF controls. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0235Penetration testing · PolicyRCF-0236Penetration testing · ProcessRCF-0237Penetration testing · Technical
ISO/IEC 27001:2022 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Risk assessment and treatment plan
The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.
Audit evidence and corrective actions log
The file where proof that controls work is kept, plus the tracking of audit findings through to closure.
From the Sekit evidence catalog
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves ID.RA-06?”
Also via MCP, free with account