Has your organization clearly communicated the roles and responsibilities for managing cybersecurity supply chain risks related to third parties?

Clarity of ownership over supply-chain cyber risk is what reviewers want, namely whether roles and responsibilities for managing third-party risks have been defined and communicated. Clear role definition ensures accountability for tasks such as vendor risk assessments, contract security requirements, ongoing monitoring, and incident response related to third parties.

Evidence could include an organizational chart showing supply chain security responsibilities, internal communications about these roles (such as emails or intranet posts), documented RACI matrices for third-party risk management, or formal policies that define these responsibilities across departments like Procurement, Legal, IT, and Security.