Additional solutions for assuring and standardising the information used in cyber risk management Respondents were asked whether additional solutions are required for assuring and standardising information used in cyber risk management. This question was answered by 85 respondents, with three quarters stating that additional solutions are required (75%). Respondents who highlighted that there should be additional solutions were asked to state which types of information should be assured or standardised. This question was answered by 60 respondents with: e¢ 83% indicating the need for additional solutions that good looks like’, that being, what constitutes effective ¢ 78% indicating that threat identification information standardised. ¢ 70% indicating the need for additional assurance and information on the impact of cyber incidents. assure and standardise ‘what cyber risk management. should be assured and standardisation of The majority of respondents think the information used in organisational cyber risk management decisions should be assured or standardised, with particular emphasis on what ‘good’ risk management looks like Q17: What types of information should be assured or standardised? 83% 10% a What ‘good’ looks like and how effective businesses are at managing their cyber risk The impact (costs) of a cyber incident 18% 7 Threat identification ; Other Base: All who responded (60) Half of respondents (50%) also stated that other information should be assured or standardised. Examples of suggestions include: best practice examples, what cyber security controls to apply to address vulnerabilities, roles and responsibilities within organisations, cyber insurance guidance, and guidance on training for senior staff. Solutions that assure or standardise the key information underpinning cyber risk management decisions 21/27