Sekit CSF · Governance & Risk · Process
RCF-0032Control testing program
Control testing results are tracked and drive remediation actions
Mapping at a glance
RCF-0032Control testing programGovernance & Risk · Process
A.5.27Learning from information security incidentsISO/IEC 27001:2022A.5.35Independent review of information securityISO/IEC 27001:2022A.5.36Compliance with policies, rules and standards for information securityISO/IEC 27001:2022GV.RM-05Lines of communication for risk establishedNIST CSF 2.0ID.IM-01Improvements from evaluationsNIST CSF 2.0
RCF-0032 maps to 8 controls across the published frameworks. +3 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.27Learning from information security incidentsrelatedTurning failed control tests into tracked remediation is a parallel improvement loop to incident lessons learned, sharing the same close-the-loop discipline.A.5.35Independent review of information securitysupportsRecording what passed and failed in scheduled control tests, with tracked remediation, is the evidence base an independent review draws on.A.5.36Compliance with policies, rules and standards for information securitysupportsThis process control runs planned control tests on schedule and turns every failure into a tracked remediation action, the follow-through A.5.36 requires of compliance testing.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.RM-05Lines of communication for risk establishedID.IM-01Improvements from evaluationsID.IM-02Improvements from tests and exercisesID.IM-03Improvements from operations
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Security metrics report
The report or dashboard the company uses to measure how its security is doing (e.g. incidents, pending patches, training completion) and present it to leadership.
From the Sekit evidence catalog
This topic through the other lenses
All Governance & Risk controls
Ask Sekura: “What evidence proves RCF-0032?”
Also via MCP, free with account