Sekit CSF · Cloud Security · Policy
RCF-0331Shared responsibility model
Security responsibilities between the company and its cloud providers are formally understood and documented
Mapping at a glance
RCF-0331Shared responsibility modelCloud Security · Policy
A.5.19Information security in supplier relationshipsISO/IEC 27001:2022 · Annex A controlsA.5.23Information security for use of cloud servicesISO/IEC 27001:2022 · Annex A controlsGV.OC-04Critical objectives and services understoodNIST CSF 2.0GV.SC-01Supply chain risk program establishedNIST CSF 2.0GV.SC-05Supply chain requirements in contractsNIST CSF 2.0
RCF-0331 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.19Information security in supplier relationshipssupportsDocumenting which security duties a cloud or SaaS provider covers, and which remain the company's, is A.5.19's supplier risk requirement applied to the specific case of cloud services.A.5.23Information security for use of cloud servicessupportsThe shared-responsibility policy facet documents, provider by provider, exactly which security duties are the company's, the starting point A.5.23 requires before anything else.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.OC-04Critical objectives and services understoodGV.SC-01Supply chain risk program establishedGV.SC-05Supply chain requirements in contracts
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
This topic through the other lenses
All Cloud Security controls
Ask Sekura: “What evidence proves RCF-0331?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.