NIST CSF 2.0 · derived mapping target
RS.CO-02Stakeholders notified
Notify the appropriate internal and external stakeholders about incidents, on time and through the right channels, including any required regulatory reporting.
Mapping at a glance
RS.CO-02Stakeholders notifiedNIST CSF 2.0
RS.CO-02 is covered by 9 Sekit CSF controls. +4 more in the table below. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0262Roles & communications · PolicyRCF-0263Roles & communications · ProcessRCF-0264Roles & communications · TechnicalRCF-0271Notification & escalation · PolicyRCF-0272Notification & escalation · ProcessRCF-0273Notification & escalation · TechnicalRCF-0286Crisis management · PolicyRCF-0287Crisis management · ProcessRCF-0288Crisis management · Technical
ISO/IEC 27001:2022 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
ISO/IEC 42001:2023 — Annex A counterparts
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Incident response plan
The plan defining how the company acts when a security incident occurs: who does what, who is notified, and within what timeframes.
Crisis communications plan
The plan defining how the company communicates during and after a serious incident: what is said to employees, customers, regulators and the public, who the spokesperson is, through which channels, and with what approved messaging.
From the Sekit evidence catalog
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves RS.CO-02?”
Also via MCP, free with account