4. Mitigation activities and associated costs (35 respondents): Respondents mentioned that this information is used for financial decision making, predominantly to determine the budget for cyber risk management. Some respondents mentioned that the cost of investing in mitigations is assessed against the likelihood of the organisation experiencing a cyber incident and the potential impact of a cyber incident. These costs are often assessed against other budget priorities. Limitations listed included that cyber risk assessment models are not robust, reputational harm is hard to quantify and that cyber investment is seen as optional rather than essential. Other types of information is also used to inform cyber risk management decisions A quarter of respondents stated that other types of information is also used by organisations to inform cyber security investment decisions (26%). This included information on: e e e * e organisational risk appetite and tolerance thresholds the organisation’s budget priorities regulatory requirements and the risk of penalties comparisons against peer or competitor organisations supply chain requirements set out by organisations that procure services or products ¢ an organisation’s cyber risk management from audit findings. Summary of ‘commercial barriers and incentives’ Responses to this section confirmed that a lack of commercial rationale is a significant barrier to effective cyber risk management, especially for micro and small organisations. Responses also demonstrated that the main causes of this lack of commercial rationale are the cost of investing in cyber risk mitigations without evidence to demonstrate a return on investment, and a lack of prioritisation among organisations. The Call for Evidence findings confirm that information on threat, vulnerability, impact and risk mitigation activities is required to make effective commercial decisions and is critical to ensuring organisations are prioritising and appropriately investing in cyber risk mitigations. This evidence in this section demonstrates that many organisations are currently using impact information to inform their cyber security investment decisions. However, Section 3 outlines the limitations in the use of this information. The evidence, however, also highlights that cyber security investment is not underpinned by clear, easily accessible or assured sources of information on the above areas and accordingly, in the short to medium term, it is likely that organisations will continue to face barriers in developing be a lack of strong commercial rationale for investment in their cyber security risk mitigation activities. 3. Access to the right information for effective cyber risk management 15/27