Findings from this section of the Call for Evidence validate DCMS’ understanding of the main barriers to organisations undertaking effective cyber risk management, with over 70% of respondents agreeing that a lack of ability, complexity and insecurity of the digital environment, and a lack of commercial rationale all present a moderate or severe barrier to organisations managing their risk effectively. Findings have also highlighted that DCMS should consider how to address the lack of incentives to support organisations with protecting their organisation online, and the insufficient regulation to compel organisations to more effectively manage their cyber risk. Government intervention to date has focused on addressing the barriers of inability and complexity and insecurity of the digital environment: * A lack of ability has started to be improved largely through advice, guidance, and investment in cyber skills and professionalisation. * In recent years, the Government has also increasingly started focusing efforts on addressing complexity and insecurity of the digital environment through a number of policy interventions which seek to reduce risk upstream, such as through the Secure by Design and Active Cyber Defence programmes. However, despite this Government action, these barriers still remain, indicating that there is still more to be done by Government in these areas. In particular, the Call for Evidence responses suggest that additional advice, guidance and support, and standards and frameworks that set out good practice could help to further reduce these barriers. 2. Commercial barriers and incentives for investing in effective cyber risk management In recent years, the Government has increasingly focused efforts on improving organisational capability and more recently, on securing the digital environment, with less focus on what is required to enable organisations to create a commercial rationale for investment in cyber security. Through the Call for Evidence, DCMS therefore sought industry input and evidence to better understand what drives and inhibits a strong commercial case for investment in cyber security, particularly where information is limited in its availability and there is inadequate assurance about its credibility. It should be noted that many of the additional barriers that respondents outlined in response the Call for Evidence were encompassed in the definition of a lack of strong commercial rationale: e A key theme in submissions to the Call for Evidence was that organisations find it difficult to demonstrate a return on investment as they are unable to quantify the level of cyber risk and therefore cannot develop a business case that justifies investment in cyber risk mitigations. e Respondents also highlighted that organisations find it difficult to demonstrate compelling cases for return on investment on cyber security due to a lack of information about the threat and potential impact. Organisations do not believe they will be targeted and do not fully recognise the potential impacts if they are targeted. 10/27