Has your organization formally documented the roles and responsibilities for cybersecurity risk management, including RACI (Responsible, Accountable, Consulted, Informed) designations?

Accountability for cyber risk is the focus, asking whether you have formally documented cybersecurity risk management roles and responsibilities, including RACI designations. Without clear ownership and communication channels, critical security tasks may fall through the cracks, leading to unaddressed vulnerabilities and confusion during security incidents.

Acceptable evidence would include a RACI matrix or similar documentation that identifies specific individuals or roles responsible for cybersecurity activities, approval authorities (accountable parties), subject matter experts to be consulted, and stakeholders who need to be kept informed. This might be part of a broader Information Security Management System (ISMS) document, security policies, or risk management framework.