Sekit CSF · Privacy · Process
RCF-0356Privacy risk assessments (DPIA)
Privacy impact assessments are consistently conducted for high-risk processing and results drive decisions
Mapping at a glance
RCF-0356Privacy risk assessments (DPIA)Privacy · Process
A.5.34Privacy and protection of personal identifiable information (PII)ISO/IEC 27001:2022GV.RM-03Cyber risk in enterprise risk managementNIST CSF 2.0ID.RA-01Vulnerabilities identified and recordedNIST CSF 2.0ID.RA-03Threats identified and recordedNIST CSF 2.0A.5.2AI system impact assessment processISO/IEC 42001:2023 — Annex A
RCF-0356 maps to 7 controls across the published frameworks. +2 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.RM-03Cyber risk in enterprise risk managementID.RA-01Vulnerabilities identified and recordedID.RA-03Threats identified and recorded
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
A.5.2AI system impact assessment processsupportsScreening new processing and running a full DPIA for high-risk cases is the closest existing mechanism to an AI impact assessment when personal data is in scope.A.5.3Documentation of AI system impact assessmentssupportsRunning a DPIA for high-risk processing produces a record close to what documentation retention needs, but it does not itself require versioning across changes.A.5.4Assessing AI system impact on individuals or groups of individualssupportsRunning a full DPIA when triggers are met is the closest existing process, but it screens for privacy harm rather than differential or accessibility impact.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
DPIA and cross-border transfer records
The privacy impact assessments done before new data processing and the records of personal-data transfers to other countries.
From the Sekit evidence catalog
This topic through the other lenses
All Privacy controls
Ask Sekura: “What evidence proves RCF-0356?”
Also via MCP, free with account