Sekit CSF · Cloud Security · Policy
RCF-0331Shared responsibility model
Security responsibilities between the company and its cloud providers are formally understood and documented
Mapping at a glance
RCF-0331Shared responsibility modelCloud Security · Policy
A.5.19Information security in supplier relationshipsISO/IEC 27001:2022A.5.23Information security for use of cloud servicesISO/IEC 27001:2022GV.OC-04Critical objectives and services understoodNIST CSF 2.0GV.SC-01Supply chain risk program establishedNIST CSF 2.0GV.SC-05Supply chain requirements in contractsNIST CSF 2.0
RCF-0331 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.19Information security in supplier relationshipssupportsDocumenting which security duties a cloud or SaaS provider covers, and which remain the company's, is A.5.19's supplier risk requirement applied to the specific case of cloud services.A.5.23Information security for use of cloud servicessupportsThe shared-responsibility policy facet documents, provider by provider, exactly which security duties are the company's, the starting point A.5.23 requires before anything else.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.OC-04Critical objectives and services understoodGV.SC-01Supply chain risk program establishedGV.SC-05Supply chain requirements in contracts
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
This topic through the other lenses
All Cloud Security controls
Ask Sekura: “What evidence proves RCF-0331?”
Also via MCP, free with account