Has your organization formally documented and communicated cybersecurity roles and responsibilities for all employees and third-party stakeholders?

Clearly assigned cybersecurity responsibilities are what reviewers look for here, covering whether roles are documented and communicated to both employees and third-party stakeholders.

Without clearly defined roles and responsibilities, critical security tasks may be overlooked, creating vulnerabilities in your security posture.

This includes defining who is responsible for activities like incident response, access management, security monitoring, and compliance across internal teams and external parties like vendors and service providers.

Evidence could include a RACI matrix or similar document that outlines cybersecurity responsibilities, job descriptions that include security duties, security clauses in third-party contracts, or a formal security organization chart with defined roles.