Has your organization established a responsibility matrix that clearly defines roles for cybersecurity supply chain risk management activities?

A responsibility matrix (such as RACI - Responsible, Accountable, Consulted, Informed) documents which teams or individuals are responsible for specific supply chain security activities, ensuring clear ownership and communication channels. This prevents critical security tasks from falling through the cracks and establishes accountability for supply chain risk management across the organization. Evidence could include a formal RACI chart or responsibility matrix document that maps supply chain security activities to specific roles, teams or individuals, with clear designation of who is responsible, accountable, consulted, and informed for each activity.