Have you established a formal program to ensure third-party stakeholders (suppliers, customers, partners) understand their cybersecurity roles and responsibilities?

Educating external parties on their security duties is the focus here: whether you run a formal program ensuring suppliers, customers, and partners understand their cybersecurity roles and responsibilities. Effective third-party security awareness helps prevent incidents caused by external stakeholders who may not be familiar with your security requirements or who might inadvertently introduce risks.

Evidence could include: third-party security training materials, signed security responsibility acknowledgments, onboarding documentation for partners that includes security responsibilities, security requirements in contracts, or records of security awareness sessions conducted with external stakeholders.