Has your organization formally documented and communicated cybersecurity responsibilities across operations, risk management, and internal audit functions?

This question assesses whether your organization has clearly defined who is responsible for various cybersecurity activities across different organizational functions, ensuring accountability and preventing gaps in security coverage. Clear role definition helps prevent confusion during security incidents and ensures proper segregation of duties between operational teams implementing controls, risk teams evaluating effectiveness, and audit teams providing independent verification. Evidence could include a RACI (Responsible, Accountable, Consulted, Informed) matrix for cybersecurity activities, formal job descriptions that include cybersecurity responsibilities, or organizational charts with security responsibilities clearly mapped to different teams and roles.