¢ Investment in cyber security is commercially viable for smaller organisations: A small number of respondents highlighted that smaller organisations have a strong commercial rationale to invest in cyber security as smaller organisations have a lower cyber risk posture, and therefore need basic and more affordable cyber security with these products and services being relatively secure by default/ design. ¢ Organisations recognise impacts of lack of investment: Regardless of the size of organisation, respondents highlighted that for organisations with strong commercial drivers for investment, this is based on a recognition of the impacts of cyber breaches and attacks. Organisations can therefore develop a case for the return on investment, particularly by identifying the potential financial impacts, such as the company suffering reputational damage if it experiences a significant cyber attack. ¢ Organisations recognise the commercial advantages of investing in cyber security: Only a small number of respondents highlighted that some organisations realise the advantages of investing in cyber security, such as how it can provide competitive advantage and protect the organisation’s intellectual property. Information used by organisations to inform cyber security investment decisions The Call for Evidence highlighted that, although cyber risk management decisions are often underpinned by a risk management assessment using complex methods and models, in simple terms, the main information that informs these decisions includes some combination of: a. Vulnerabilities (e.g. what assets and how the company might be attacked) b. Threat (e.g. frequency and severity) c. Impact or harm of cyber incidents (e.g. direct and indirect costs) d. Mitigation activities and associated costs (e.g. activities such as the implementation of cyber security controls or training which constitute effective mitigation). The Call for Evidence asked respondents for insights on the types of information used most by organisations to inform cyber security investment decisions. This question was answered by 81 respondents, with 89% stating that information on the impact or harm of cyber incidents is used to inform cyber risk management decisions. Between 56% and 65% of respondents stated that information on the threat level, vulnerabilities and mitigation activities is also used. 13/27