Has your organization formally designated specific roles or positions responsible for cybersecurity supply chain risk management activities?

Establishing clear ownership for supply chain risk management ensures accountability and prevents critical security tasks from falling through organizational gaps. These designated roles should have defined responsibilities for identifying, assessing, and mitigating risks from third-party vendors, suppliers, and service providers throughout the supply chain lifecycle. Evidence could include an organizational chart highlighting these positions, formal job descriptions that explicitly mention supply chain risk management responsibilities, or a RACI matrix (Responsible, Accountable, Consulted, Informed) for supply chain security activities.