2. Are you aware of any other key barriers to effective cyber risk management that are not captured in the 3 barriers highlighted? Single response (Yes/No) . [If Yes at Q2] Please provide any evidence or examples you have of other key barriers to effective cyber risk management. Open response . What evidence do you have for how Government and/or industry could help address the following two barriers, in addition to the existing interventions outlined? Barrier 1 - Inability Open response Barrier 2 - Complexity and insecurity of the digital environment. Open response . How much of a barrier is a lack of commercial rationale to organisations managing their cyber risk effectively? Please answer for each of the organisation sizes below. Single code/matrix (Not a barrier, Somewhat of a barrier, Moderate barrier, Severe barrier) / (Micro organisations (Less than 10 employees); small organisations (1049 employees; medium organisations (50-249 employees); large organisations (250 or more employees)) . [If moderate barrier/severe barrier for any organisation size] What are the reasons for a lack of strong commercial rationale for the following organisations to invest in cyber security? [organisation sizes selected at Q2] Please provide evidence to support your answer. Open response . [If not a barrier/ somewhat of a barrier] What evidence do you have that there is a strong commercial rationale for the following organisations to invest in cyber security? [organisation sizes selected at Q2] Please provide evidence to support your answer. Open response . In your experience, which of the following information is used by organisations to inform cyber security investment decisions? Please select all that apply Threat level Vulnerabilities Impact or harm of cyber incidents Mitigation activities and associated costs . [For those selected at Q8] In your experience, how is this information used by organisations to inform cyber security investment decisions? Please provide any evidence you have for how this information is used. Threat level; Vulnerabilities; Impact or harm of cyber incidents; Mitigation activities and associated costs; Open response 10. How much of a barrier do you think each of the below issues are to organisations managing their cyber risk effectively? a. Businesses do not have or draw on the right information about the cyber threat or their own cyber risk posture; b. The direct and indirect impacts of a cyber attack are not fully recognised by the organisation; c. There is no agreed definition of effective risk management; Single code per option (Not a barrier, Somewhat of a barrier, Moderate barrier, Severe barrier). 26/27