priority. This information failure is supported by Government Office for Science research that indicates that not all organisations have the knowledge, understanding and confidence around cyber security in order to implement appropriate measures. 4. Future policy and regulatory interventions The final section of the Call for Evidence sought industry engagement on future policy and regulatory interventions that could help to normalise investment in cyber security across the UK economy and improve cyber risk management in organisations. Respondents were asked to provide evidence of the solutions organisations currently have for assuring and standardising information used in cyber risk management; whether additional solutions are required; what types of information should be assured or standardised and how Government or industry could help to generate more useful information. Respondents were also asked what is required to improve responsibility and accountability at a senior level within organisations. Current solutions organisations have for assuring and standardising the information used in cyber risk management Solutions that organisations currently use for assuring and standardising the information used in cyber risk management were provided by 69 respondents. This was asked as an open question, with responses coded into themes. Solutions were predominantly industry frameworks and standards; and Government regulation and standards. ¢ Government regulation and standards (35%): Of Government regulation, standards and frameworks, most commonly mentioned were NCSC’s Cyber Essentials, General Data Protection Regulation (GDPR) and the Security of Network & Information Systems Directive’s (NIS) Cyber Assessment Framework (CAF). More broadly, some mentioned NCSC guidance as a solution for assuring and standardising information. e Industry standards and frameworks (45%): The most commonly referenced industry frameworks and standards were International Organization for Standardization’s (ISO) certifications, such as ISO 27001, 27002, 27701 and 27005, and the National Institute of Standards and Technology’s (NIST) framework. ¢ Other: A small number of respondents mentioned other commercial offerings or informal industry information networks. Other types of products mentioned included general risk management solutions, risk maturity models and cyber threat intelligence. Some respondents mentioned services that provide organisations with support for assuring and standardising information, specifically consultancies and internal audit services, and the cyber insurance industry. Some respondents noted the limitations of existing solutions for assuring and standardising information used in cyber risk management, including that current solutions are not fit for purpose, there are too many frameworks and standards, and issues with implementation prevent effective cyber risk management. 20/27