e Some respondents therefore noted that, due to these information failures, organisations see cyber security solely as a cost to business without a strong corresponding understanding of the benefits of investment in cyber risk mitigation. Extent to which a lack of commercial rationale presents a barrier Respondents were asked how much of a barrier a lack of commercial rationale is to organisations of various sizes. A majority of respondents saw it as a moderate to severe barrier for organisations of all sizes. However, a lack of commercial rationale was more likely to be thought of as a severe barrier for micro and small organisations (69%), while a quarter of respondents saw this as a severe barrier for large organisations. A lack of commercial rationale is seen to be a severe barrier particularly for micro and small organisations Q5: How much of a barrier is a lack of commercial rationale to organisations managing their cyber risk effectively? (asked for each organisation size) lob 25% @ Severe barrier = Moderate barrier Somewhat of a barrier 27% 11% aa 9% a: Micro organisations Small organisations 13% a Medium organisations = Not a barrier Large organisations Base: All who responded about Micro organisations (90), Small organisations (89), Medium organisations (88), Large organisations (91) Reasons for a lack of strong commercial rationale to invest in cyber security The Call for Evidence asked for input on why there is a lack of commercial rationale for organisations of all sizes to invest in cyber security, and 81 respondents provided a broad number of reasons. This was asked as an open question, with responses coded into themes, including: 11/27