Has your organization formally documented and communicated its cybersecurity risk management policy, processes, and procedures to all relevant stakeholders?

Documented and well-circulated guidance is the concern: the question asks whether your cybersecurity risk management policy, processes, and procedures are formally recorded and shared with relevant stakeholders. Proper communication ensures all employees understand their roles in managing cybersecurity risks, the procedures to follow, and how risk decisions are made within the organization.

Evidence could include: distribution logs of policy documents, intranet screenshots showing where policies are published, training records covering risk management procedures, signed acknowledgments from employees, or meeting minutes where policies were presented and discussed.