Collective responsibility is the idea that more than one stakeholder shares duty for reducing a common risk. In cyber security, that means security is not owned only by the organization that runs a system: vendors, contractors, cloud providers, customers, and regulators may all influence the final level of protection. The term is closely linked to shared infrastructure and supply-chain risk, where a weakness in one place can affect many others.
This matters because attackers often target the easiest link in a connected environment, not just the main organization. A secure internal network can still be exposed by a weak third-party service, poor procurement, or inconsistent baseline controls. Defenses that reflect collective responsibility include vendor due diligence, shared standards, incident-reporting rules, coordinated patching, and clear accountability across partners. The goal is to treat resilience as a system property, not just an internal IT task.