Has your organization identified and documented all internal stakeholders and their specific cybersecurity expectations?

This question assesses whether your organization has formally identified key internal stakeholders (such as executives, board members, department heads, and employees) and documented their specific cybersecurity expectations, requirements, and risk tolerances. For example, the CFO may have specific expectations regarding financial data protection, while the CTO may focus on system availability metrics. Evidence could include a stakeholder register or matrix that lists all internal stakeholders, their roles, their specific cybersecurity expectations, and how these expectations align with the organization's overall security strategy. This document should be regularly reviewed and updated as organizational priorities shift.