Are cybersecurity responsibilities and performance requirements explicitly included in job descriptions and personnel documentation?

Accountability through documentation is what's assessed, meaning whether cybersecurity duties and performance expectations are written explicitly into job descriptions and personnel records. By embedding security responsibilities in job descriptions, organizations establish that cybersecurity is part of regular job functions rather than an optional activity, and create measurable performance criteria related to security practices.

Evidence could include sample job descriptions with highlighted cybersecurity components, HR documentation templates showing security responsibility sections, or performance evaluation forms that include security metrics for different roles. For technical roles, these might specify secure coding practices or system hardening responsibilities, while non-technical roles might include data handling protocols or incident reporting requirements.