Have you established documented performance goals for personnel with cybersecurity risk management responsibilities and implemented a process to measure their performance against these goals?

Accountability for cybersecurity risk managers is the focus here, covering whether you set documented performance goals and measure staff against them. Establishing measurable goals creates accountability and helps identify skill gaps or areas where additional training or resources may be needed.

Regular performance measurement enables continuous improvement in your security posture by ensuring cybersecurity staff are effectively executing their responsibilities.

Evidence could include: documented job descriptions with cybersecurity performance metrics, performance review templates specific to security roles, reports showing periodic performance evaluations of security personnel, or improvement plans developed based on performance measurements.