¢ The cost of investing in cyber risk mitigations without evidence of the benefits of that investment (63%): Many respondents mentioned a lack of dedicated cyber security budgets as cyber risk mitigation is seen as expensive. Organisations find it difficult to justify these budgets as they cannot prove there is a return on investment, particularly as they lack data or evidence that would enable them to better justify investment. A smaller proportion of respondents also highlighted that some organisations, particularly those in a supply chain, are expected to invest more in cyber security than is commercially viable in order to protect other organisations. ¢ Lack of prioritisation (48%): Respondents highlighted that organisations do not prioritise cyber risk as they do not understand or recognise the cyber threat they face. Organisations also have to focus on more pressing priorities and business operations and do not have capacity to also focus on and mitigate cyber risk. ¢ Limited understanding of the impact of a cyber breach (25%): A factor contributing to organisations finding it difficult to developing a compelling case for investment in cyber risk management is that organisations lack an understanding of the impact of a cyber breach, including not believing they will be targeted and therefore impacted, and only anticipating part of the impact that they will experience. e¢ Lack of capability (31%): The submissions also indicated that organisations do not have enough experienced staff to properly assess and mitigate cyber risk. This included the lack of a skilled workforce, but also highlighted barriers in the lack of dedicated staff that organisations have to adequately assess the risk they face and particularly, the lack of understanding of an organisation’s assets. ¢ Lack of responsibility (12%): Respondents highlighted that a lack of responsibility, including at Board level, was also making it more difficult for organisations to justify investment in cyber security. Organisations outsourcing their cyber risk management was also identified as a contributing factor. Identified reasons why there is already a strong commercial rationale for organisations to invest in cyber security The Call for Evidence asked respondents that were aware of strong commercial drivers for organisations investing in their cyber risk management to provide the reasons and evidence that underpinned this driver. This was asked as an open question, with responses from 42 responses coded into themes, including that: e There is a rationale for larger organisations to invest in cyber security: Respondents highlighted that large organisations do understand the cyber risk, recognise the impact of cyber incidents and have more resources to manage their cyber security effectively. A small number of respondents also mentioned that larger organisations have more assets to protect and therefore find it less challenging to demonstrate compelling cases for return on investment on cyber security. 12/27