SekitCrosswalk
ENES
Empieza ahora
Sekit CSF · Familia

Governance & Risk

36 controles en 12 temas, cada uno visto a través de las lentes de política, proceso y técnica.

Política

RCF-0031Control testing program8 mapeosSecurity controls are regularly tested to verify they work as intendedRCF-0013Exception management4 mapeosExceptions to security policies are formally documented and approvedRCF-0022Internal audit4 mapeosThe company conducts formal internal audits of its security controlsRCF-0034Issues management7 mapeosSecurity issues and findings are formally tracked until resolutionRCF-0019Metrics & reporting7 mapeosSecurity performance is measured using defined metricsRCF-0001Policy management4 mapeosThe company has a formal written security policy approved by leadershipRCF-0016Regulatory compliance7 mapeosThe company formally tracks applicable laws and regulationsRCF-0007Risk assessment7 mapeosThe company formally identifies and documents its security risksRCF-0010Risk treatment5 mapeosThe company has a formal plan to address identified security risksRCF-0004Roles & responsibilities6 mapeosSecurity roles and responsibilities are formally defined and assignedRCF-0028Security charter6 mapeosLeadership has formally approved and sponsored the security programmeRCF-0025Third-party risk management11 mapeosThird party suppliers and vendors are formally assessed for security risk

Proceso

RCF-0032Control testing program8 mapeosControl testing results are tracked and drive remediation actionsRCF-0014Exception management4 mapeosException approvals follow a consistent process with defined time limitsRCF-0023Internal audit6 mapeosInternal audit findings are tracked and remediated within agreed timelinesRCF-0035Issues management7 mapeosIssues are assigned owners and resolved within agreed timelinesRCF-0020Metrics & reporting7 mapeosSecurity metrics are regularly reviewed and reported to leadershipRCF-0002Policy management6 mapeosSecurity policies are consistently communicated and followed across the organisationRCF-0017Regulatory compliance8 mapeosRegulatory requirements are consistently implemented across the organisationRCF-0008Risk assessment8 mapeosRisk assessments are conducted regularly and drive security decisionsRCF-0011Risk treatment6 mapeosRisk treatment actions are tracked and completed within agreed timelinesRCF-0005Roles & responsibilities9 mapeosSecurity responsibilities are understood and consistently fulfilledRCF-0029Security charter4 mapeosThe security programme has visible leadership support and adequate resourcesRCF-0026Third-party risk management13 mapeosThird party security requirements are consistently enforced through contracts

Técnica

RCF-0033Control testing program7 mapeosAutomated tools regularly test technical controlsRCF-0015Exception management4 mapeosTechnical controls flag or compensate for approved policy exceptionsRCF-0024Internal audit6 mapeosTechnical tools support automated audit evidence collectionRCF-0036Issues management6 mapeosTechnical tools track and escalate unresolved security issuesRCF-0021Metrics & reporting7 mapeosTechnical dashboards provide real-time visibility of security metricsRCF-0003Policy management7 mapeosTechnical controls enforce compliance with security policiesRCF-0018Regulatory compliance9 mapeosTechnical controls support compliance with regulatory requirementsRCF-0009Risk assessment8 mapeosRisk assessment processes are supported by technical tools and dataRCF-0012Risk treatment8 mapeosTechnical controls implement the agreed risk treatment measuresRCF-0006Roles & responsibilities8 mapeosSystems enforce role-based security responsibilitiesRCF-0030Security charter3 mapeosTechnical infrastructure reflects leadership commitment to security investmentRCF-0027Third-party risk management13 mapeosTechnical controls monitor third party access and activity

Esta familia en ISO/IEC 27001:2022

Cada elemento de marco al que mapean los controles de la familia, primero los más conectados; agrupado por familia del Sekit CSF, nunca por el índice del propio marco.

A.5.36 Compliance with policies, rules and standards for information securityA.5.35 Independent review of information securityA.5.4 Management responsibilitiesA.8.16 Monitoring activitiesA.5.1 Policies for information securityA.8.15 LoggingA.5.7 Threat intelligenceA.8.9 Configuration managementA.8.8 Management of technical vulnerabilitiesA.5.31 Legal, statutory, regulatory and contractual requirementsA.5.27 Learning from information security incidentsA.5.2 Information security roles and responsibilitiesA.5.25 Assessment and decision on information security eventsA.5.22 Monitoring, review and change management of supplier servicesA.5.26 Response to information security incidentsA.8.29 Security testing in development and acceptanceA.8.24 Use of cryptographyA.5.34 Privacy and protection of personal identifiable information (PII)A.5.18 Access rightsA.5.15 Access controlA.5.24 Information security incident management planning and preparationA.5.37 Documented operating proceduresA.5.19 Information security in supplier relationshipsA.8.2 Privileged access rightsA.5.21 Managing information security in the ICT supply chainA.5.33 Protection of recordsA.5.20 Addressing information security within supplier agreementsA.5.28 Collection of evidenceA.5.8 Information security in project managementA.8.34 Protection of information systems during audit testingA.6.2 Terms and conditions of employmentA.5.3 Segregation of duties

Esta familia en NIST CSF 2.0

GV.RM-05 Lines of communication for risk establishedGV.RM-06 Standardized risk method establishedGV.PO-02 Cybersecurity policy maintainedID.IM-04 Response and recovery plans maintainedID.IM-03 Improvements from operationsGV.OC-01 Organizational mission understoodID.IM-02 Improvements from tests and exercisesGV.RM-07 Strategic opportunities characterizedGV.PO-01 Cybersecurity policy establishedGV.RR-01 Leadership accountability for cyber riskID.IM-01 Improvements from evaluationsID.RA-01 Vulnerabilities identified and recordedGV.SC-06 Due diligence before engagementGV.OC-03 Legal and regulatory requirements understoodGV.SC-04 Suppliers known and prioritizedGV.SC-07 Supplier risk managed over relationshipGV.OC-04 Critical objectives and services understoodGV.OC-05 Dependencies understoodGV.RM-03 Cyber risk in enterprise risk managementGV.SC-01 Supply chain risk program establishedGV.SC-03 Supply chain risk integratedGV.SC-05 Supply chain requirements in contractsGV.OC-02 Stakeholder needs understoodGV.RR-02 Roles and responsibilities establishedGV.SC-08 Suppliers in incident planningGV.RM-01 Risk management objectives establishedGV.RM-02 Risk appetite and tolerance establishedID.RA-02 Threat intelligence receivedGV.RM-04 Risk response strategy establishedGV.RR-03 Resources allocated for cybersecurityGV.RR-04 Cybersecurity in human resourcesGV.SC-02 Supplier roles and responsibilities establishedGV.SC-09 Supply chain practices integrated in lifecycle

Esta familia en ISO/IEC 42001:2023 — Annex A

A.6.2.4 AI system verification and validationA.5.2 AI system impact assessment processA.3.3 Reporting of concernsA.8.3 External reportingA.3.2 AI roles and responsibilitiesA.7.3 Acquisition of dataA.2.2 AI policyA.2.3 Alignment with other organisational policiesA.2.4 Review of the AI policy

Esta familia en Cyber Essentials

CE3.2 Apply critical updates within 14 daysCE2.2 Change default and guessable passwordsCE4.1 Manage the account lifecycleCE4.2 Control administrative privilegesCE2.3 Enforce device unlocking credentials
Pregúntale a Sekura: «¿Qué evidencia demuestra Governance & Risk?»
También vía MCP, gratis con cuenta