Has your organization documented cybersecurity supply chain risk management roles and responsibilities in a formal policy?

Supply chain accountability is under review, namely whether you have documented the roles and responsibilities for managing cybersecurity risk across vendors in a formal policy. Documenting these roles ensures accountability, prevents gaps in oversight, and establishes clear procedures for addressing supply chain security incidents or vulnerabilities.

Evidence could include a formal supply chain risk management policy document that explicitly defines roles and responsibilities for activities such as vendor security assessments, continuous monitoring, incident response related to supply chain, and remediation processes. The policy should identify specific positions or teams responsible for each aspect of supply chain security management.