e Other information (7%): Some respondents mentioned the need for other kinds of information, for example, information that is tailored or relevant to specific types of organisations or sectors. Respondents also provided suggestions of how this information should be provided This was asked as an open question, with responses coded into themes, including: e Advice, guidance and support (28%): Suggestions included cyber risk management training, improving cyber expertise in organisations and additional advice and guidance more generally. e Standards/ frameworks/ models (9%): Some respondents suggested standards that enabled more effective risk assessments, and that these standards should be supported by models that enable an organisation to receive a score on how effectively they are managing their cyber risk. Barriers preventing organisations from creating, collecting or accessing this information Details on barriers preventing organisations from currently creating, collecting or accessing the information they require was provided by 77 respondents. This was asked as an open question, with responses coded into themes. These barriers included: ¢ Information failures (40%): Issues in this category were broad ranging - from some respondents outlining the difficulties of information overload, to others highlighting the lack of existence of other types of information needed to support cyber risk assessments. Responses further focused on organisations not having access to the right information; and a lack of information sharing. e Lack of knowledge and understanding (36%): Over a third of respondents highlighted a lack of knowledge, understanding and awareness as a barrier preventing organisations from creating, collecting or accessing information. ¢ Lack of resources (32%): Respondents specifically mentioned a lack of funding, time, dedicated staff and trusted resources. Some also commented that the current commercial offerings are overpriced. ¢ Lack of prioritisation (27%): A lack of motivation and prioritisation was identified as a barrier to organisations developing and using cyber risk management information, including amongst board members. ¢ No standardised approach (22%): Respondents stated that there are too many cyber risk management frameworks and standards, with some specifically mentioning that existing frameworks are not suitable for some types of organisation. ¢ Lack of regulation (10%): Some respondents highlighted that a lack of appropriate or enforced regulation creates a barrier for the creation and use of information as without such regulation organisations have little appetite to seek out cyber risk management information. Evidence of how the market is currently effectively addressing information transparency barriers 18/27