Sekit CSF · Governance & Risk · Policy

RCF-0007Risk assessment

The company formally identifies and documents its security risks

Mapping at a glance

RCF-0007Risk assessmentGovernance & Risk · Policy

A.5.7Threat intelligenceISO/IEC 27001:2022 GV.RM-01Risk management objectives establishedNIST CSF 2.0 GV.RM-02Risk appetite and tolerance establishedNIST CSF 2.0 GV.RM-03Cyber risk in enterprise risk managementNIST CSF 2.0 ID.RA-01Vulnerabilities identified and recordedNIST CSF 2.0

RCF-0007 maps to 7 controls across the published frameworks. +2 more in the table below. Open in the full graph →

Maps to ISO/IEC 27001:2022

Curated mapping with the reasoning, not just the codes.

A.5.7Threat intelligenceenablesThis policy control documents a repeatable method for identifying and recording risks, the structure threat intelligence needs to feed into for A.5.7 to matter.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

GV.RM-01Risk management objectives established GV.RM-02Risk appetite and tolerance established GV.RM-03Cyber risk in enterprise risk management ID.RA-01Vulnerabilities identified and recorded ID.RA-02Threat intelligence received

Maps to ISO/IEC 42001:2023 — Annex A

Curated mapping with the reasoning, not just the codes.

A.5.2AI system impact assessment processsupportsDocumenting a repeatable risk assessment method gives the AI impact process its backbone, but the general policy names no AI-specific triggers or harms.

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Risk assessment and treatment plan

The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.

From the Sekit evidence catalog

This topic through the other lenses

All Governance & Risk controls

Ask Sekura: “What evidence proves RCF-0007?”

Also via MCP, free with account