Has your organization formally documented the incident response roles and responsibilities for both internal teams and external suppliers?

This question assesses whether your organization has clearly defined who is responsible for what actions during security incidents, both within your organization and among your suppliers or vendors. Clear role definition prevents confusion during incidents, ensures proper coordination, and establishes accountability for incident response activities across organizational boundaries. Evidence could include an Incident Response Plan document that contains a RACI matrix (Responsible, Accountable, Consulted, Informed) or similar responsibility chart that maps specific incident response activities to roles within your organization and to relevant supplier organizations. The document should clearly indicate which party is responsible for incident detection, analysis, containment, eradication, and recovery activities.