Has your organization formally documented the roles and responsibilities for cybersecurity risk management, including RACI (Responsible, Accountable, Consulted, Informed) designations?

This question assesses whether your organization has clearly defined who owns cybersecurity risk management activities and how information flows between stakeholders. Without clear ownership and communication channels, critical security tasks may fall through the cracks, leading to unaddressed vulnerabilities and confusion during security incidents. Acceptable evidence would include a RACI matrix or similar documentation that identifies specific individuals or roles responsible for cybersecurity activities, approval authorities (accountable parties), subject matter experts to be consulted, and stakeholders who need to be kept informed. This might be part of a broader Information Security Management System (ISMS) document, security policies, or risk management framework.