Have you established a formal program to ensure third-party stakeholders (suppliers, customers, partners) understand their cybersecurity roles and responsibilities?

This question assesses whether your organization has implemented structured processes to educate and inform external parties about their security obligations when accessing or handling your systems and data. Effective third-party security awareness helps prevent incidents caused by external stakeholders who may not be familiar with your security requirements or who might inadvertently introduce risks. Evidence could include: third-party security training materials, signed security responsibility acknowledgments, onboarding documentation for partners that includes security responsibilities, security requirements in contracts, or records of security awareness sessions conducted with external stakeholders.