Sekit CSF · Governance & Risk · Policy

RCF-0010Risk treatment

The company has a formal plan to address identified security risks

Mapping at a glance

RCF-0010Risk treatmentGovernance & Risk · Policy

A.5.8Information security in project managementISO/IEC 27001:2022 GV.RM-04Risk response strategy establishedNIST CSF 2.0 GV.RM-05Lines of communication for risk establishedNIST CSF 2.0 GV.RM-06Standardized risk method establishedNIST CSF 2.0 GV.RM-07Strategic opportunities characterizedNIST CSF 2.0

RCF-0010 maps to 5 controls across the published frameworks. Open in the full graph →

Maps to ISO/IEC 27001:2022

Curated mapping with the reasoning, not just the codes.

A.5.8Information security in project managementsupportsThis policy control keeps a leadership-approved plan for treating identified risks, the artifact a project must produce before launch to satisfy A.5.8.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

GV.RM-04Risk response strategy established GV.RM-05Lines of communication for risk established GV.RM-06Standardized risk method established GV.RM-07Strategic opportunities characterized

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Risk assessment and treatment plan

The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.

From the Sekit evidence catalog

This topic through the other lenses

All Governance & Risk controls

Ask Sekura: “What evidence proves RCF-0010?”

Also via MCP, free with account