The information most required in cyber security investment decisions is information covering the impact or harm caused by cyber incidents Q8: In your experience, which of the following information is used by organisations to inform cyber security investment decisions? 89% 56% ; Threat level 65% 98% / Vulnerabilities 7 Impact orharm of cyberincidents Mitigation activities and associated costs Other Base: All who responded (81) Use of this information was detailed by respondents as follows: 1. Threat Level (45 respondents provided detail of how threat information is used): Some mentioned that threat level information is predominantly used to estimate likelihood of a cyber incident which informs a risk assessment. This information is used to determine cyber risk management decisions such as the level of investment and in which business areas to focus investment. 2. Vulnerabilities (28 respondents): Respondents mentioned that known vulnerabilities are used to drive prioritisation of cyber security investment, to quantify the level of risk exposure that an organisation faces, for example, through penetration testing. Some respondents identified limitations, including that smaller companies are less able to identify vulnerabilities and that this information is not well understood by non-technical audiences. 3. Impact or harm of cyber incidents (51 respondents): Respondents highlighted that information on the impact of a cyber incident was used by organisations. Information used included: * External cyber incidents such as publicised reports of attacks on similar types of organisations, reviewing breach notifications from the news, reports from the Information Commissioner’s Office (ICO) or relevant authorities. Information on external incidents was noted to increase awareness amongst the board of organisations. * An assessment of the potential financial impacts and reputational damage that an organisation could experience. In particular, it was noted that this information was used to Inform contingency planning. 14/27