A third of respondents suggested implementing new or extending regulation (30%); a quarter of respondents (24%) thought that investment could be stimulated through the creation of new standards and frameworks or the increased promotion of existing standards and frameworks; and 16% suggested the use of financial incentives, for example, grants to cover accreditation. Other recommendations included building capability through the provision of cyber security education and training (14%), additional advice guidance and support (14%) and the need for products to be secure by design (3%). Summary of ‘future policy and regulatory interventions’ This section highlighted the main solutions that organisations currently use for assuring and standardising the information used in cyber risk management, including the Government’s existing implementation of Cyber Essentials, General Data Protection Regulation (GDPR), the Network and Information Systems Regulations (NIS) Cyber Assessment Framework, and industry standards and frameworks such as ISO certifications and NIST. Despite the existence and use of these standards and frameworks, many respondents agreed that more information is required around outlining what comprises effective cyber risk management, the full potential impacts that might be experienced from a cyber attack and additional threat information. It was suggested this additional assured information could be created and made available with improved standards and frameworks, either new or existing. However, the Call for Evidence findings highlighted that there is also support for organisations to be required to take more responsibility and accountability for effective cyber risk management through the implementation of additional regulation, either to increase responsibility and accountability at the senior level or more generally to stimulate investment in effective cyber risk management. Next steps As put forth in the Call for Evidence, the development of policy interventions that help support recovery and future resilience of organisations across the UK will be most effective when done in partnership and with an understanding of what works, so it is important that a wide range of views from organisations of all sizes and sectors is captured in the development of new policy interventions. If we want to see sustained cultural change across organisations, we need to ensure that this work engages all organisations that influence and set market standards and act as drivers for corporate governance, risk management and business continuity. DCMS will continue to progress the development of new interventions, and we will set out further detail on policy proposals in this area over the coming months, as set out below. Next steps include: 24/27