SekitCrosswalk
ENES
Start free trial
NIST CSF 2.0 · derived mapping target

RS.AN-07Incident data preserved

Collect incident data and metadata and protect their integrity and chain of custody, so evidence remains trustworthy for analysis or legal use.

Mapping at a glance
RS.AN-07Incident data preservedNIST CSF 2.0
RCF-0277Post-incident review (lessons learned)Incident Response · PolicyRCF-0278Post-incident review (lessons learned)Incident Response · ProcessRCF-0279Post-incident review (lessons learned)Incident Response · TechnicalRCF-0415Problem managementSecure Operations · PolicyRCF-0416Problem managementSecure Operations · Process

RS.AN-07 is covered by 6 Sekit CSF controls. +1 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0277Post-incident review (lessons learned) · PolicyRCF-0278Post-incident review (lessons learned) · ProcessRCF-0279Post-incident review (lessons learned) · TechnicalRCF-0415Problem management · PolicyRCF-0416Problem management · ProcessRCF-0417Problem management · Technical

ISO/IEC 27001:2022 · Annex A controls counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.27 Learning from information security incidentsA.8.16 Monitoring activitiesA.8.15 LoggingA.5.24 Information security incident management planning and preparationA.5.26 Response to information security incidentsA.5.37 Documented operating procedures

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Incident playbooks, exercises and forensics readiness
The step-by-step guides for the most likely incidents, the tabletop exercises, the post-incident review reports, and how evidence is preserved so an incident can be investigated.
Logging and monitoring configuration
How the company collects and keeps activity logs from its systems, and how security alerts are generated and handled.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

ID.IM-04 Response and recovery plans maintainedRS.AN-08 Incident magnitude estimatedRS.MA-04 Incidents escalated
Ask Sekura: “What evidence proves RS.AN-07?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk
  1. In Claude or ChatGPT, add a custom connector and paste this URL.
  2. Sign in with your email to finish. Free, read-only, no organization required.