SekitCrosswalk
ENES
Start now
Sekit CSF · Family

Governance & Risk

36 controls in 12 topics, each seen through the policy, process and technical lenses.

Policy

RCF-0031Control testing program8 mappingsSecurity controls are regularly tested to verify they work as intendedRCF-0013Exception management4 mappingsExceptions to security policies are formally documented and approvedRCF-0022Internal audit4 mappingsThe company conducts formal internal audits of its security controlsRCF-0034Issues management7 mappingsSecurity issues and findings are formally tracked until resolutionRCF-0019Metrics & reporting7 mappingsSecurity performance is measured using defined metricsRCF-0001Policy management4 mappingsThe company has a formal written security policy approved by leadershipRCF-0016Regulatory compliance7 mappingsThe company formally tracks applicable laws and regulationsRCF-0007Risk assessment7 mappingsThe company formally identifies and documents its security risksRCF-0010Risk treatment5 mappingsThe company has a formal plan to address identified security risksRCF-0004Roles & responsibilities6 mappingsSecurity roles and responsibilities are formally defined and assignedRCF-0028Security charter6 mappingsLeadership has formally approved and sponsored the security programmeRCF-0025Third-party risk management11 mappingsThird party suppliers and vendors are formally assessed for security risk

Process

RCF-0032Control testing program8 mappingsControl testing results are tracked and drive remediation actionsRCF-0014Exception management4 mappingsException approvals follow a consistent process with defined time limitsRCF-0023Internal audit6 mappingsInternal audit findings are tracked and remediated within agreed timelinesRCF-0035Issues management7 mappingsIssues are assigned owners and resolved within agreed timelinesRCF-0020Metrics & reporting7 mappingsSecurity metrics are regularly reviewed and reported to leadershipRCF-0002Policy management6 mappingsSecurity policies are consistently communicated and followed across the organisationRCF-0017Regulatory compliance8 mappingsRegulatory requirements are consistently implemented across the organisationRCF-0008Risk assessment8 mappingsRisk assessments are conducted regularly and drive security decisionsRCF-0011Risk treatment6 mappingsRisk treatment actions are tracked and completed within agreed timelinesRCF-0005Roles & responsibilities9 mappingsSecurity responsibilities are understood and consistently fulfilledRCF-0029Security charter4 mappingsThe security programme has visible leadership support and adequate resourcesRCF-0026Third-party risk management13 mappingsThird party security requirements are consistently enforced through contracts

Technical

RCF-0033Control testing program7 mappingsAutomated tools regularly test technical controlsRCF-0015Exception management4 mappingsTechnical controls flag or compensate for approved policy exceptionsRCF-0024Internal audit6 mappingsTechnical tools support automated audit evidence collectionRCF-0036Issues management6 mappingsTechnical tools track and escalate unresolved security issuesRCF-0021Metrics & reporting7 mappingsTechnical dashboards provide real-time visibility of security metricsRCF-0003Policy management7 mappingsTechnical controls enforce compliance with security policiesRCF-0018Regulatory compliance9 mappingsTechnical controls support compliance with regulatory requirementsRCF-0009Risk assessment8 mappingsRisk assessment processes are supported by technical tools and dataRCF-0012Risk treatment8 mappingsTechnical controls implement the agreed risk treatment measuresRCF-0006Roles & responsibilities8 mappingsSystems enforce role-based security responsibilitiesRCF-0030Security charter3 mappingsTechnical infrastructure reflects leadership commitment to security investmentRCF-0027Third-party risk management13 mappingsTechnical controls monitor third party access and activity

This family in ISO/IEC 27001:2022

Every framework item the family's controls map to, most-connected first — grouped by Sekit CSF family, never by the framework's own index.

A.5.36 Compliance with policies, rules and standards for information securityA.5.35 Independent review of information securityA.5.4 Management responsibilitiesA.8.16 Monitoring activitiesA.5.1 Policies for information securityA.8.15 LoggingA.5.7 Threat intelligenceA.8.9 Configuration managementA.8.8 Management of technical vulnerabilitiesA.5.31 Legal, statutory, regulatory and contractual requirementsA.5.27 Learning from information security incidentsA.5.2 Information security roles and responsibilitiesA.5.25 Assessment and decision on information security eventsA.5.22 Monitoring, review and change management of supplier servicesA.5.26 Response to information security incidentsA.8.29 Security testing in development and acceptanceA.8.24 Use of cryptographyA.5.34 Privacy and protection of personal identifiable information (PII)A.5.18 Access rightsA.5.15 Access controlA.5.24 Information security incident management planning and preparationA.5.37 Documented operating proceduresA.5.19 Information security in supplier relationshipsA.8.2 Privileged access rightsA.5.21 Managing information security in the ICT supply chainA.5.33 Protection of recordsA.5.20 Addressing information security within supplier agreementsA.5.28 Collection of evidenceA.5.8 Information security in project managementA.8.34 Protection of information systems during audit testingA.6.2 Terms and conditions of employmentA.5.3 Segregation of duties

This family in NIST CSF 2.0

GV.RM-05 Lines of communication for risk establishedGV.RM-06 Standardized risk method establishedGV.PO-02 Cybersecurity policy maintainedID.IM-04 Response and recovery plans maintainedID.IM-03 Improvements from operationsGV.OC-01 Organizational mission understoodID.IM-02 Improvements from tests and exercisesGV.RM-07 Strategic opportunities characterizedGV.PO-01 Cybersecurity policy establishedGV.RR-01 Leadership accountability for cyber riskID.IM-01 Improvements from evaluationsID.RA-01 Vulnerabilities identified and recordedGV.SC-06 Due diligence before engagementGV.OC-03 Legal and regulatory requirements understoodGV.SC-04 Suppliers known and prioritizedGV.SC-07 Supplier risk managed over relationshipGV.OC-04 Critical objectives and services understoodGV.OC-05 Dependencies understoodGV.RM-03 Cyber risk in enterprise risk managementGV.SC-01 Supply chain risk program establishedGV.SC-03 Supply chain risk integratedGV.SC-05 Supply chain requirements in contractsGV.OC-02 Stakeholder needs understoodGV.RR-02 Roles and responsibilities establishedGV.SC-08 Suppliers in incident planningGV.RM-01 Risk management objectives establishedGV.RM-02 Risk appetite and tolerance establishedID.RA-02 Threat intelligence receivedGV.RM-04 Risk response strategy establishedGV.RR-03 Resources allocated for cybersecurityGV.RR-04 Cybersecurity in human resourcesGV.SC-02 Supplier roles and responsibilities establishedGV.SC-09 Supply chain practices integrated in lifecycle

This family in ISO/IEC 42001:2023 — Annex A

A.6.2.4 AI system verification and validationA.5.2 AI system impact assessment processA.3.3 Reporting of concernsA.8.3 External reportingA.3.2 AI roles and responsibilitiesA.7.3 Acquisition of dataA.2.2 AI policyA.2.3 Alignment with other organisational policiesA.2.4 Review of the AI policy

This family in Cyber Essentials

CE3.2 Apply critical updates within 14 daysCE2.2 Change default and guessable passwordsCE4.1 Manage the account lifecycleCE4.2 Control administrative privilegesCE2.3 Enforce device unlocking credentials
Ask Sekura: “What evidence proves Governance & Risk?”
Also via MCP, free with account