Despite many organisations requiring impact information to make investment decisions, the majority stated that organisations not fully recognising impacts is a moderate/ severe barrier, highlighting the need for further good quality impact information Q10: How much of — r a barrier do you think. each of . the below. issues are to . . organisations in managing their cyber risk effectively? Severe harrier 100% = Moderate 0 80% barrier 60% a Somewhat : of a barrier 40% 20% ; 0% . Businesses do not have access toor draw on the right information about the cyber threat or their own cyber risk posture ae The direct and indirect impacts ofa cyber attack are not fully recognised by the organisation - There is no agreed definition of effective risk management aNota barrier Base: All who responded (85) Information that would allow organisations to make better investment decisions in cyber security Respondents were asked to provide input on what information would allow organisations to make better investment decisions in cyber security, with 80 respondents answering this open response question!{22tnete 3] Responses have been coded into themes. Suggested information included: ¢ Cyber threat (20%): A fifth of respondents highlighted that additional information on the cyber threat would be beneficial to organisations. ¢ Vulnerabilities (43%): Some respondents thought that additional information on vulnerabilities information would be useful, with a small number specifically referencing information for more effective asset management and protection. ¢ Impact or harm of cyber incidents (21%): Where respondents were specific about the types of impact or harm information that would be useful, they mentioned the need for more case studies and stories, and tools to support organisations to carry out cyber impact assessments. e Mitigation activities and associated costs (27%): Specific suggestions from respondents included information that could inform a return on investment case, including more information on costs of mitigative activities. Respondents also highlighted that organisations would benefit from products that enabled more effective benchmarking against organisations with similar cyber risk postures, and a means to better manage supply chain risks. 17/27