27 Section 4 OUR NATIONAL RESPONSE and organisations what they need to do to protect themselves online, and where necessary, set the standards we expect key companies and organisations to meet. 4.11. Although key sectors of our economy are in private hands, the Government is ultimately responsible for assuring their national resilience and, with its partners across the administration, the maintenance of essential services and functions across the whole of government. Driving change: the role of the market 4.12. The 2011 Strategy and National Cyber Security Programme sought to drive outcomes and increase capacity in both the public and private sector by looking to the market to drive the right behaviours. We expected commercial pressures and government-instigated incentives to ensure adequate business investment in appropriate cyber security, to stimulate a flow of investment into our industry, and to encourage an adequate pipeline of skills into the sector. 4.13. Much has been achieved. Across the economy and wider society, awareness of the risk and of the actions required to mitigate cyber risk have increased over the last five years. But the combination of market forces and government encouragement has not been sufficient in itself to secure our long-term interests in cyberspace at the pace required. Too many networks, including in critical sectors, are still insecure. The market is not valuing, and therefore not managing, cyber risk correctly. Too many organisations are still suffering breaches at even the most basic level. Too few investors are willing to risk supporting entrepreneurs in the sector. Too few graduates and others with the right skills are emerging from the education and training system. 4.14. The market still has a role to play and in the longer term will deliver greater impact than the Government ever can. However, the immediacy of the threat facing the UK and the expanding vulnerabilities of our digitalised environment call for greater action in the short term from the Government. Driving change: expanded role for the Government 4.15. The Government must therefore set the pace in meeting the country’s national cyber security needs. Only Government can draw on the intelligence and other assets required to defend the country from the most sophisticated threats. Only Government can drive cooperation across the public and private sectors and ensure information is shared between the two. Government has a leading role, in consultation with industry, in defining what good cyber security looks like and ensuring it is implemented. 4.16. The Government will bring about a significant improvement in our national cyber security over the next five years. This ambitious and transformational programme will focus on the following four broad areas: • Levers and incentives. The Government will invest to maximise the potential of a truly innovative UK cyber sector. We will do this by supporting start-ups and investing in innovation. We will also seek to identify and bring on talent earlier in the education system and develop clearer routes into a profession that needs better definition. The Government will also make use of all available levers, including the forthcoming General Data Protection Regulation (GDPR), to drive up standards of cyber security across the economy, including, if required, through regulation. National Cyber Security Strategy 2016