e alack of incentives to support organisations with protecting their organisation online, and ¢ insufficient regulation to compel organisations to more effectively manage their cyber risk. Barrier 1 - A lack of ability Many of the additional barriers identified by respondents related to a lack of capability and skills within organisations, particularly among board members. Respondents highlighted that organisations lack: e board and senior level capability and responsibility for cyber risk. ¢ askilled and experienced cyber security workforce with the resources required to manage cyber risk, including a lack of dedicated and/ or experienced staff, time constraints, and limited financial resources. e understanding and clarity regarding the appropriate cyber security practice and requirements. Respondents also highlighted that organisations do not understand what action should be taken given the confusion caused by numerous tools and frameworks across industry. Evidence for how Government and/or industry could address the barrier of inability was provided by 81 respondents. This was asked as an open question, with responses coded into themes, including: e Advice, guidance and support (58%): A large proportion of respondents suggested that inability could be addressed through improved advice, guidance and support, including improving training, awareness and understanding at all levels of organisations, as well as specifically at the board level. Some respondents suggested the need to further develop the cyber security industry and encourage the upskilling of cyber security professionals. There was a key theme of increased cyber security awareness and training outside of the workplace, with some submissions highlighting the need to provide cyber security education from a young age and industry taking more responsibility for providing additional training and support to employees. ¢ Incentives (21%): Respondents indicated that there is a need to further incentivise organisations. Suggestions include: providing free certified resources and services, financial incentives to encourage organisations to invest in training. e Standards and frameworks (11%): A small proportion of respondents called for the development of appropriate security standards and certifications to ensure organisations understand what is required to mitigate cyber risk effectively. 8/27