Are cybersecurity responsibilities and performance requirements explicitly included in job descriptions and personnel documentation?

This question assesses whether your organization has formally documented cybersecurity duties within employee role descriptions, ensuring accountability and clear expectations for security-related tasks. By embedding security responsibilities in job descriptions, organizations establish that cybersecurity is part of regular job functions rather than an optional activity, and create measurable performance criteria related to security practices. Evidence could include sample job descriptions with highlighted cybersecurity components, HR documentation templates showing security responsibility sections, or performance evaluation forms that include security metrics for different roles. For technical roles, these might specify secure coding practices or system hardening responsibilities, while non-technical roles might include data handling protocols or incident reporting requirements.