Are cybersecurity supply chain risk management responsibilities and performance requirements explicitly included in relevant job descriptions and personnel documentation?

Including specific cybersecurity supply chain risk management responsibilities in job descriptions creates clear accountability and ensures staff understand their security obligations when dealing with vendors and third parties. This practice helps organizations operationalize supply chain security by making it part of formal role expectations rather than an implicit or ad-hoc responsibility.

Evidence could include: sample job descriptions for procurement, vendor management, or IT security roles that explicitly mention supply chain security responsibilities; performance evaluation criteria that include supply chain risk management metrics; or HR documentation templates that incorporate cybersecurity supply chain responsibilities for relevant positions.