Has your organization established a formal cross-departmental communication framework for cybersecurity risks?

This question assesses whether your organization has defined clear channels and processes for how different departments (management, operations, IT, legal, HR, etc.) share information about cybersecurity threats, vulnerabilities, and incidents. Effective cross-departmental communication ensures that security risks are properly escalated, addressed holistically, and that response efforts are coordinated across the organization. Evidence could include a documented communication plan or matrix that outlines roles, responsibilities, escalation paths, and communication channels for cybersecurity risks. This might take the form of a formal policy document, communication flowchart, RACI matrix specific to security incidents, or meeting cadence documentation showing regular cross-functional security discussions.