Whilst the second part of the Call for Evidence sought input on what information needs organisations have in informing commercial decision making processes, the third part focused on the specific barriers organisations are experiencing in accessing this information. As tested in the Call for Evidence and outlined in Section 2 of this public response, access to the appropriate information to inform risk management decisions is a prerequisite for an organisation making sound investments in cyber security. Conversely, where this information is not available, organisations face a key barrier to determining the level and type of investment appropriate to their cyber risk posture. The Call for Evidence tested three information failures that had been identified through Government research and engagement: e Some organisations often either do not draw on, find it difficult to engage with, or do not invest in information about cyber threats and their exposure to them. e The direct and indirect impacts of a cyber attack are often not fully recognised. Businesses often do not understand the totality of either short or long-term, indirect and intangible costs associated with a cyber attack (e.g. fines, share price or client/ customer base loss). e There is no agreed definition or standard of effective risk management, which leads to businesses not knowing how they should invest or the potential cost of mitigation activity. This section asked respondents how much of a barrier each of the three identified information-based issues posed to organisations. Respondents were also asked about what other information would allow organisations to make better investment decisions; the barriers to creating, collecting or accessing this information; and how the market is currently addressing these information transparency barriers. Information barriers to organisations managing their cyber risk effectively As highlighted below, a majority of respondents agreed that the three information failures outlined in the Call for Evidence presented severe or moderate barriers: e Not having the right information on the potential impacts of a cyber attack was thought to be the most significant barrier, with just under half of respondents stating that this is a severe barrier for organisations (47%). ¢ No agreed definition of effective risk management was thought to be a severe barrier by four in ten respondents (38%). e Businesses not having the right information on the cyber threat was identified as a severe barrier by a third of respondents (32%). 16/27