Has your organization formally assigned responsibilities for processing, analyzing, and responding to cybersecurity disclosures from external parties, and do you verify these procedures are being executed?

Handling inbound cybersecurity disclosures is the focus here, covering whether you have assigned responsibility for processing and responding to reports from external parties and confirm those procedures run. Having defined roles and responsibilities ensures that vulnerability disclosures and threat intelligence are properly processed, impact-analyzed, and responded to in a timely manner rather than being overlooked or handled inconsistently.

Evidence could include a documented RACI matrix or responsibility assignment chart specifically for external disclosure handling, job descriptions that explicitly include these duties, or process documentation showing the workflow for handling external security disclosures with named roles. Meeting minutes or audit logs demonstrating regular verification that these procedures are being followed would also serve as supporting evidence.