Sekit CSF · Familia
Governance & Risk
36 controles en 12 temas, cada uno visto a través de las lentes de política, proceso y técnica.
Política
RCF-0031Control testing programsin mapeos aúnSecurity controls are regularly tested to verify they work as intendedRCF-0013Exception managementsin mapeos aúnExceptions to security policies are formally documented and approvedRCF-0022Internal auditsin mapeos aúnThe company conducts formal internal audits of its security controlsRCF-0034Issues managementsin mapeos aúnSecurity issues and findings are formally tracked until resolutionRCF-0019Metrics & reportingsin mapeos aúnSecurity performance is measured using defined metricsRCF-0001Policy managementsin mapeos aúnThe company has a formal written security policy approved by leadershipRCF-0016Regulatory compliancesin mapeos aúnThe company formally tracks applicable laws and regulationsRCF-0007Risk assessmentsin mapeos aúnThe company formally identifies and documents its security risksRCF-0010Risk treatmentsin mapeos aúnThe company has a formal plan to address identified security risksRCF-0004Roles & responsibilitiessin mapeos aúnSecurity roles and responsibilities are formally defined and assignedRCF-0028Security chartersin mapeos aúnLeadership has formally approved and sponsored the security programmeRCF-0025Third-party risk managementsin mapeos aúnThird party suppliers and vendors are formally assessed for security risk
Proceso
RCF-0032Control testing programsin mapeos aúnControl testing results are tracked and drive remediation actionsRCF-0014Exception managementsin mapeos aúnException approvals follow a consistent process with defined time limitsRCF-0023Internal auditsin mapeos aúnInternal audit findings are tracked and remediated within agreed timelinesRCF-0035Issues managementsin mapeos aúnIssues are assigned owners and resolved within agreed timelinesRCF-0020Metrics & reportingsin mapeos aúnSecurity metrics are regularly reviewed and reported to leadershipRCF-0002Policy managementsin mapeos aúnSecurity policies are consistently communicated and followed across the organisationRCF-0017Regulatory compliancesin mapeos aúnRegulatory requirements are consistently implemented across the organisationRCF-0008Risk assessmentsin mapeos aúnRisk assessments are conducted regularly and drive security decisionsRCF-0011Risk treatmentsin mapeos aúnRisk treatment actions are tracked and completed within agreed timelinesRCF-0005Roles & responsibilitiessin mapeos aúnSecurity responsibilities are understood and consistently fulfilledRCF-0029Security chartersin mapeos aúnThe security programme has visible leadership support and adequate resourcesRCF-0026Third-party risk managementsin mapeos aúnThird party security requirements are consistently enforced through contracts
Técnica
RCF-0033Control testing programsin mapeos aúnAutomated tools regularly test technical controlsRCF-0015Exception managementsin mapeos aúnTechnical controls flag or compensate for approved policy exceptionsRCF-0024Internal auditsin mapeos aúnTechnical tools support automated audit evidence collectionRCF-0036Issues managementsin mapeos aúnTechnical tools track and escalate unresolved security issuesRCF-0021Metrics & reportingsin mapeos aúnTechnical dashboards provide real-time visibility of security metricsRCF-0003Policy managementsin mapeos aúnTechnical controls enforce compliance with security policiesRCF-0018Regulatory compliancesin mapeos aúnTechnical controls support compliance with regulatory requirementsRCF-0009Risk assessmentsin mapeos aúnRisk assessment processes are supported by technical tools and dataRCF-0012Risk treatmentsin mapeos aúnTechnical controls implement the agreed risk treatment measuresRCF-0006Roles & responsibilitiessin mapeos aúnSystems enforce role-based security responsibilitiesRCF-0030Security chartersin mapeos aúnTechnical infrastructure reflects leadership commitment to security investmentRCF-0027Third-party risk managementsin mapeos aúnTechnical controls monitor third party access and activity
Pregúntale a Sekura: «¿Qué evidencia demuestra Governance & Risk?»
Conecta tu IA · MCP gratis
https://staging.sekit.ai/api/mcp/crosswalk- En Claude o ChatGPT, añade un conector personalizado y pega esta URL.
- Inicia sesión con tu correo para terminar. Gratis, de solo lectura, sin necesidad de organización.