Sekit CSF · Governance & Risk · Policy
RCF-0019Metrics & reporting
Security performance is measured using defined metrics
Mapping at a glance
RCF-0019Metrics & reportingGovernance & Risk · Policy
A.5.35Independent review of information securityISO/IEC 27001:2022A.5.36Compliance with policies, rules and standards for information securityISO/IEC 27001:2022GV.RM-05Lines of communication for risk establishedNIST CSF 2.0GV.RM-06Standardized risk method establishedNIST CSF 2.0ID.IM-01Improvements from evaluationsNIST CSF 2.0
RCF-0019 maps to 7 controls across the published frameworks. +2 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.35Independent review of information securitysupportsDefining a small set of security indicators, what each measures and what triggers action, gives independent reviewers something concrete to check against.A.5.36Compliance with policies, rules and standards for information securityenablesThis policy control defines a small set of security indicators, who produces them and what triggers action, the measurement basis A.5.36's compliance monitoring relies on.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.RM-05Lines of communication for risk establishedGV.RM-06Standardized risk method establishedID.IM-01Improvements from evaluationsID.IM-02Improvements from tests and exercises
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Security metrics report
The report or dashboard the company uses to measure how its security is doing (e.g. incidents, pending patches, training completion) and present it to leadership.
From the Sekit evidence catalog
This topic through the other lenses
All Governance & Risk controls
Ask Sekura: “What evidence proves RCF-0019?”
Also via MCP, free with account