Sekit CSF · Compliance & Audit · Process
RCF-0374Control evidence management
Control evidence is consistently gathered, labelled and stored in a way that supports audit and review
Mapping at a glance
RCF-0374Control evidence managementCompliance & Audit · Process
A.5.33Protection of recordsISO/IEC 27001:2022A.5.36Compliance with policies, rules and standards for information securityISO/IEC 27001:2022GV.RM-05Lines of communication for risk establishedNIST CSF 2.0ID.IM-03Improvements from operationsNIST CSF 2.0ID.IM-04Response and recovery plans maintainedNIST CSF 2.0
RCF-0374 maps to 9 controls across the published frameworks. +4 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.33Protection of recordssupportsCollecting and filing control evidence consistently as work happens is a form of record protection that keeps proof available and unaltered for the retention period required.A.5.36Compliance with policies, rules and standards for information securitysupportsThis process control collects and files control evidence as work happens, named and dated consistently, so any control's operation can be demonstrated on demand under A.5.36.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.RM-05Lines of communication for risk establishedID.IM-03Improvements from operationsID.IM-04Response and recovery plans maintained
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
A.5.3Documentation of AI system impact assessmentssupportsFiling evidence consistently as work happens is exactly the discipline an AI impact assessment record needs, applied here to a document that is not yet named as in scope.A.6.2.3Documentation of AI system design and developmentsupportsCollecting and dating evidence as work happens is the discipline that keeps AI documentation current, applied here to a document type it does not yet name.A.6.2.7AI system technical documentationsupportsRCF-0374 files evidence as work happens, a discipline the AI documentation pack can borrow, but it never produces the architecture, data lineage or retirement plan A.6.2.7 requires.A.8.2System documentation and information for userssupportsRCF-0374's evidence-collection habit, filing proof as work happens, applies well to user documentation distribution records, but the underlying content, what users are told about an AI system's limits, still has to be written from scratch.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Audit evidence and corrective actions log
The file where proof that controls work is kept, plus the tracking of audit findings through to closure.
From the Sekit evidence catalog
This topic through the other lenses
All Compliance & Audit controls
Ask Sekura: “What evidence proves RCF-0374?”
Also via MCP, free with account