68 respondents provided suggestions for how Government or industry could develop solutions to provide an assured or standardised approach to defining and assessing the key information underpinning cyber risk management. This was asked as an open question, with responses coded into themes. These included: ¢ Improved frameworks and standards (49%): Half of respondents highlighted the need to promote existing industry frameworks, improving or extending existing Government frameworks and create new standards or frameworks. A smaller proportion of respondents suggested that development of a model that enabled organisations to be scored for how effectively they were managing their cyber risk. Some respondents also highlighted that existing frameworks need to be made more accessible (e.g. in terms of cost). e Additional assurance mechanisms (19%): A fifth of respondents mentioned the need for additional assurance mechanisms, specifically that there should be a system of external verification or accreditation. e Additional regulation (18%): Some respondents suggested regulation would provide additional assurance and standardisation of cyber risk information, for example, by mandating existing Government standards such as Cyber Essentials, enforcing existing industry standards, or by embedding cyber risk management in the corporate reporting. ¢ Provision of incentives (15%): Respondents suggested that a solution would require increased incentivisation, including financial incentives (e.g. tax breaks or tax-free dividend) or improved information sharing and collaboration. e Advice, guidance and support (16%): Some respondents also suggested that additional advice, guidance and support could improve the key information underpinning cyber risk management ¢ International alignment (7%): A small proportion of respondents highlighted the need for solutions to be aligned with other international solutions. Approaches Government or industry could take to make cyber risk management information more transparent, accessible and trusted 64 respondents highlighted how Government or industry could make the key information used in cyber risk management more transparent, accessible and trusted. This was asked as an open question, with responses coded into themes. Suggestions included: e Advice, guidance and support (41%): Specific solutions included delivering cyber risk management training, providing a common language to talk about cyber risk, reducing the use of technical language, and making information available for free. ¢ Collaboration (30%): Collaboration and information sharing was highlighted by almost a third of respondents, through industry and government information sharing, collaborating across industry in peer to peer sharing networks, and the facilitation of anonymised information sharing. 22/27