¢ Regulation (14%): Some respondents mentioned the need for additional regulation, including mandated standards, cyber security training at the board level or cyber risk management responsibility at the board level, and compelling organisations to have dedicated cyber security capability. ¢ Security by design (5%): A small proportion mentioned that the lack of ability would be less of a barrier if products are secure by design. This input recognises the interrelated nature of the initial 3 barriers that were presented in the Call for Evidence, namely, that the insecurity of digital products, processes and technology presents a difficult barrier in being able to mitigate their associated risks. Barrier 2 - Complexity and insecurity of the digital environment Respondents indicated that the constantly evolving digital landscape was preventing organisations from being able to be secure online. In addition, the fact that organisations’ digital products, services and operations are becoming increasingly integrated with other organisations, was identified by respondents as making it more difficult for organisations to manage cyber risk. A number of respondents mentioned further potential barriers: the openness of the internet network, and the limited requirements around digital products being secure by design. Evidence for how Government and/or industry could address this barrier was provided by 76 respondents. This was asked as an open question, with responses coded into themes, including: e Advice, guidance and support (20%): Some respondents highlighted the need for additional advice, guidance and support. Specific suggestions included that a common language around cyber risk is required, including the reduction in use of technical language and promoting a common terminology that can be used by cyber security professionals, boards and all staff within organisations. ¢ Frameworks/ standards (16%): Respondents mentioned the need for additional frameworks and standards and methods for assuring and standardising information used in cyber risk management. These are outlined in more detail in later sections. ¢ Regulation (18%): The need to implement additional regulation, or extend existing regulation was highlighted by some respondents. Suggestions for the type of regulation that should be implemented were varied, but included: additional codes of conduct or certification requirements for software engineers; mandating Cyber Essentials or another minimum cyber security standard for all organisations; and mandating secure by design requirements for IOT devices!{otnate 2], e Secure by design (16%): Some respondents also mentioned that digital products must be secure by design to reduce cyber risk before it enters the economy. ¢ Supply chain management (4%): Respondents also highlighted the need for assistance in supply chain management. Summary of ‘barriers to effective risk management’ 9/27