A third of respondents stated that there is no evidence of anything currently in the market addressing information transparency barriers (32%), while 14% stated that they did not know. However, just over half (54% of 84 respondents) stated that there is evidence that the market is currently addressing information transparency barriers: e These respondents cited services and products provided by industry, including risk management frameworks (e.g. ISO 27001), threat intelligence services and penetration testing. However, these respondents also highlighted the limitations of current industry products and services, such as tools being overpriced and organisations not being able to appropriately use the tools once purchased. Some respondents also mentioned the difficulty organisations have in selecting the appropriate products and services. e Some respondents also highlighted Government products and services that are being used by organisations and the market to address information transparency barriers. This included advice and guidance from NCSC (e.g. Cyber Essentials). e Asmall number of respondents mentioned the need for increased information sharing to address cyber risk information failures. Summary of ‘access to the right information for effective cyber risk management’ When organisations make cyber risk management decisions they draw upon estimates of the cost of investing in cyber security against the potential benefits procured or impacts mitigated. However, the Call for Evidence findings strongly indicate that information failures currently prevent most organisations from being able to conduct these cyber risk assessments. In particular, responses regarding the three information failures outlined in the Call for Evidence findings have indicated that for organisations to conduct an effective cyber risk assessment, they require additional information on: e The direct and indirect impacts of a cyber attack with 86% of respondents stating the inability to fully understand the impact of cyber attacks is a moderate or severe barrier to effective risk management. e An agreed definition of ‘good’ risk management with 65% of respondents stating this information is critical to investment decisions. This is compounded by 66% stating that the lack of an agreed definition of ‘good’ risk management is a moderate or severe barrier to mitigating their cyber risk. These findings point to ongoing market failures based on information asymmetries and imperfect information regarding cyber security risk management across the economy. The Call for Evidence responses support research which suggests that this stems from businesses not knowing enough about their cyber security risk or what forms of protection are most effective. Overarchingly, many cannot accurately calculate the cost or benefits to their business of investing in increased cyber protection, and many do not consider it a 19/27