Sekit CSF · Training & Awareness · Policy
RCF-0391Phishing simulations
The company formally conducts simulated phishing exercises to test and improve employee resilience
Mapping at a glance
RCF-0391Phishing simulationsTraining & Awareness · Policy
RCF-0391 maps to 4 controls across the published frameworks. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.6.3Information security awareness, education and trainingsupportsThis policy control mandates recurring phishing simulations with defined frequency and scope, a specific awareness exercise A.6.3 expects as part of ongoing training.A.8.7Protection against malwareenablesThis policy facet mandates recurring simulated phishing exercises with defined frequency and scope, the awareness half of A.8.7's protection, pairing technical controls with user readiness.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Phishing simulation results
The proof that phishing simulations are run to test employees and the follow-up training given to those who fall for them.
From the Sekit evidence catalog
This topic through the other lenses
All Training & Awareness controls
Ask Sekura: “What evidence proves RCF-0391?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.