Does your organization clearly communicate the consequences of cybersecurity policy violations to all employees and stakeholders?

This question assesses whether your organization has established and communicated clear consequences for violating cybersecurity policies. Employees and stakeholders should understand both personal consequences (e.g., disciplinary actions, termination) and organizational impacts (e.g., data breaches, financial losses, reputational damage, regulatory penalties) of non-compliance with security policies. Evidence could include a documented disciplinary policy specific to cybersecurity violations, acknowledgment forms signed by employees, training materials that outline consequences, or communications that reinforce the importance of compliance and the potential impacts of violations.