Does your organization include specific cybersecurity risk management provisions in contracts and agreements with suppliers and their supply chains?

This question assesses whether your organization formally documents the cybersecurity responsibilities and liabilities between all parties in the supply chain. Contracts should clearly define who is responsible for security incidents, data breaches, vulnerability management, and compliance requirements throughout the relationship lifecycle. Including these provisions helps establish accountability and ensures all parties understand their security obligations. Evidence could include sample contract templates or redacted agreements showing cybersecurity clauses, supplier security requirements documentation, or a formal supply chain risk management policy that mandates the inclusion of security provisions in all supplier contracts.