Has your organization defined and documented roles and responsibilities for cybersecurity risk management in third-party relationships, and integrated these into relevant agreements?

This question assesses whether your organization has clearly established who is responsible for managing cybersecurity risks when working with external parties like suppliers, customers, and business partners. Defining these responsibilities helps prevent security gaps where each party assumes the other is handling a particular security control. Evidence could include: documented third-party security policies, contract templates with security responsibility clauses, responsibility assignment matrices (RACI charts) for third-party security management, or redacted examples of agreements that include cybersecurity responsibility clauses.