The Call for Evidence submissions highlight a range of difficulties organisations face including not knowing what security measures to look for in a supplier; difficulties in finding sufficient companies to tender; the prioritisation of low costs; and SMEs not having enough leverage with large suppliers. This shows there is still further work to be done to embed standards through utilising procurement and supplier management as an effective market lever in holding organisations to account. Overall, the Call for Evidence responses provide detailed evidence as to the barriers organisations continue to face in managing their digital risks, which are evermore heightened in today’s environment. But perhaps more importantly, the responses provide a better understanding of what organisations need and how to develop and improve existing initiatives - whether market-based or provided by Government. Further next steps for engaging with DCMS in the development of joint Government and industry initiatives are included at the end of this public response. Industry should be encouraged to take part in this process to ensure that future interventions meet their needs and are effective in overcoming some of the core barriers as we step into an ever more digitised business environment. Introduction The Department of Digital, Culture, Media and Sport (DCMS) launched a Call for Evidence in November 2019 to seek industry evidence and insights on the barriers organisations and the economy still face in taking effective action to manage digital risks, three years after the establishment of the National Cyber Security Centre (NCSC). In the Call for Evidence an understanding of three core barriers was outlined as: ¢ Lack of ability, comprising a lack of capacity and knowledge in organisations to manage cyber risk and protect themselves online. ¢ Complexity and insecurity of the digital environment, on the basis of insecure digital products or services in use across organisations and interconnectivity between organisations within and across sectoral and geographic barriers. ¢ Lack of commercial rationale, including that organisations find it difficult to demonstrate compelling cases for return on investment on cyber security due to the lack of quantifiable information, including the financial impact, related to cyber attacks. Through the Call for Evidence, DCMS tested an understanding of these three categories, and sought input on industry’s views on the mitigating action that is still required to improve cyber risk management across the UK economy. It has been encouraging to find that respondents have generally agreed with the outline of barriers and understanding of reasons behind the lack of commercial drivers, which DCMS set out in the Call for Evidence. It is critical that the Government’s understanding of such barriers reflects the 5/27