Sekit CSF · Governance & Risk · Technical
RCF-0015Exception management
Technical controls flag or compensate for approved policy exceptions
Mapping at a glance
RCF-0015Exception managementGovernance & Risk · Technical
RCF-0015 maps to 4 controls across the published frameworks. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.8.9Configuration managementrelatedMaking approved policy exceptions visible to monitoring and pairing them with compensating measures keeps deliberate deviations from becoming untracked configuration drift.A.8.16Monitoring activitiesrelatedMaking approved exceptions visible to monitoring and pairing them with compensating controls extends A.8.16's monitoring scope to cover accepted risk, not standard activity.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Information security policy
The written, leadership-approved document that sets the company's security rules: what is protected, how, and who is responsible.
From the Sekit evidence catalog
This topic through the other lenses
All Governance & Risk controls
Ask Sekura: “What evidence proves RCF-0015?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.