Has your organization formally documented and communicated cybersecurity roles and responsibilities for all employees and third-party stakeholders?

This question assesses whether your organization has clearly defined who is responsible for various cybersecurity functions across your workforce and external partners. Without clearly defined roles and responsibilities, critical security tasks may be overlooked, creating vulnerabilities in your security posture. This includes defining who is responsible for activities like incident response, access management, security monitoring, and compliance across internal teams and external parties like vendors and service providers. Evidence could include a RACI matrix or similar document that outlines cybersecurity responsibilities, job descriptions that include security duties, security clauses in third-party contracts, or a formal security organization chart with defined roles.