NIST CSF 2.0 · derived mapping target
ID.RA-07Changes and exceptions managed
Manage changes and policy exceptions deliberately: assess their risk, record them, and track them so shortcuts do not quietly accumulate into exposure.
Mapping at a glance
ID.RA-07Changes and exceptions managedNIST CSF 2.0
RCF-0220Vulnerability remediation SLAsVulnerability & Configuration · PolicyRCF-0221Vulnerability remediation SLAsVulnerability & Configuration · ProcessRCF-0222Vulnerability remediation SLAsVulnerability & Configuration · TechnicalRCF-0229Patch prioritizationVulnerability & Configuration · PolicyRCF-0230Patch prioritizationVulnerability & Configuration · Process
ID.RA-07 is covered by 9 Sekit CSF controls. +4 more in the table below. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0220Vulnerability remediation SLAs · PolicyRCF-0221Vulnerability remediation SLAs · ProcessRCF-0222Vulnerability remediation SLAs · TechnicalRCF-0229Patch prioritization · PolicyRCF-0230Patch prioritization · ProcessRCF-0231Patch prioritization · TechnicalRCF-0232Exposure management · PolicyRCF-0233Exposure management · ProcessRCF-0234Exposure management · Technical
ISO/IEC 27001:2022 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
Cyber Essentials counterparts
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Risk assessment and treatment plan
The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.
Change and release management records
The process to review and approve changes to production systems before applying them, and how new versions are released in a controlled way.
From the Sekit evidence catalog
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves ID.RA-07?”
Also via MCP, free with account