e Further in-depth analysis of all evidence provided through the Call for Evidence, alongside other key pieces of evidence such as the recently published Cyber Security Breaches Survey 2020. New research on the impact of GDPR on security outcomes, and on a framework to analyse the full costs of cyber incidents is being published alongside with this publication. The findings, including full analysis of the sources of evidence provided in submissions to the Call for Evidence will be considered as part of DCMS’ ongoing policy development process. ¢ The development of new policy interventions. DCMS will use the findings from the Call for Evidence, along with the evidence and insights obtained through consultation and wider stakeholder engagement, to scope and analyse policy options. This will focus on what action we can take in the immediate term to support organisations through the economy’s recovery, as well as longer term perspectives on the role of the UK’s regulatory framework in helping achieve a better standard of cyber security across the economy. e Ongoing engagement with key industry and Government stakeholders. To inform the design of new policy interventions, DCMS will engage with key industry stakeholders, regulators and relevant Government departments. This engagement will seek input on the prioritised policy interventions and test whether these interventions will provide the necessary internal and external drivers to create a stronger rationale for cyber security prioritisation and investment. ¢ Publication of a policy statement and future policy recommendations. 2020 presents a number of opportunities for shaping the future direction of Government support for business cyber resilience within the broader agenda of enabling digital and tech to help us recover and grow as a nation. We will be utilising forthcoming fiscal events including the Comprehensive Spending Review and opportunities such as the publication of a new digital strategy in the Autumn to shape a refreshed strategic approach to cyber resilience, one that reflects the new post-Covid reality. This work will evaluate the work HMG has done to date on supporting businesses to improve their levels of digital resilience, reflecting on the impact advice and guidance has had alongside the sufficiency of existing regulation, including GDPR and the NIS Regulation. This future policy statement will further propose policy interventions that will support organisations to develop a compelling case for investment in cyber security and encourage organisations across the economy to take more responsibility and accountability for cyber risk management over the course of the future National Cyber Security Strategy. Annex: List of call for evidence questions 1. To what extent do you agree that the barriers outlined ((1) inability; (2) complexity and insecurity of the digital environment; and (3) lack of a strong commercial rationale) are the main barriers to organisations undertaking effective cyber risk management? Single response (Strongly agree, slightly agree, neither agree or disagree, slightly disagree, strongly disagree) 25/27