Has your organization developed a formal cybersecurity supply chain risk management program with documented policies, procedures, and an implementation plan with milestones that is shared with relevant stakeholders?

A cybersecurity supply chain risk management program helps identify, assess, and mitigate risks from third-party vendors, suppliers, and service providers that may have access to your systems or data. This program should include formal policies defining roles and responsibilities, procedures for vendor assessment and monitoring, and a roadmap for continuous improvement with clear milestones. Evidence could include: a formal supply chain risk management policy document, implementation roadmap with milestones, vendor assessment procedures, stakeholder communication plan, and documentation showing the program has been shared with relevant internal and external stakeholders.