e Frameworks and standards (27%): Suggestions were split between those who advocated the promotion of existing industry frameworks (11%) and those who suggested the creation of new frameworks (16%). Five per cent also suggested extending or improving existing Government frameworks. ¢ Regulation (13%): Suggestions for additional regulation included mandated reporting of cyber incidents and mandating minimum cyber security standards. ¢ Accreditation (11%): An accreditation scheme was suggested as a means of making the key information used in cyber risk management more robust and transparent. ¢ Government services (6%): Suggestions included Government providing additional information on official sites, and the provision of financial incentives, either through providing funds or reducing the cost of certifications. ¢ International alignment (5%): As for the previous question, a small proportion of respondents highlighted the need for solutions to be aligned internationally. Increasing responsibility and accountability for cyber risk management at the senior level Suggestions on the requirements and solutions that would ensure that, at a senior level, organisations take responsibility and accountability for effective cyber risk management were provided by 69 respondents. This was asked as an open question, with responses coded into themes, including: e Regulation (45%): Almost half suggested additional regulation. This included suggestions of mandating accountability including board members being directly accountable for cyber security or having a Chief Information Security Officer on the board, establishing director liability and compelling organisations to provide additional information through corporate reporting. A small proportion suggested that this could be achieved through extending existing regulation (6%), such as GDPR. ¢ Improved understanding (14%): Some suggested increasing responsibility and accountability could be achieved by improving understanding and knowledge, particularly through cyber risk training for Board members. ¢ Industry led enforcement (3%): A small proportion suggested that increased responsibility and accountability at a senior level could be achieved through industry initiatives such as organisations requiring their suppliers to comply to standards, and membership bodies and professional association requirements. A final open question asked respondents what more Government and/or industry could do to help to stimulate investment in effective cyber risk management. Input was provided by 63 respondents, with responses coded into themes. Suggestions provided to this question were similar to responses to other questions throughout the Call for Evidence, particularly the need for additional regulation. 23/27