realities faced by businesses. This assists in measuring the effectiveness of Government efforts to date against these barriers, as well as enabling the identification of where and what shape future policy action is required. Summary of responses In total, 138 responses were received to the Call for Evidence between 4 November and 20 December 2019. This included 29 responses from individuals, 64 from organisations, and 45 unspecified responses. Respondents were able to respond via an online survey, or via email. The Call for Evidence included a mix of open and closed questions. Respondents were not required to answer all questions. All questions and the accompanying percentages are reported based on the number of respondents that answered that individual question. This is detailed in the description of each question through each section of this public response. For open response questions, every response has been reviewed and, while not every point that was made by each respondent can be reflected, responses were coded to identify common themes. The following sections provide an overview of the key or notable themes identified, whilst providing a balanced overview to reflect the range of views expressed. This public response provides an overview of the findings we have collated through the analysis of the Call for Evidence responses. It does not set a policy direction but instead outlines a set of findings that broaden the evidence base for cyber security risk management practices and barriers across the economy. As set out in the {Next Steps}(https: //www.gov.uk/government/publications/cybersecurity-incentives-regulation-review-government-response-to-the-call-forevidence/cyber-security-incentives-regulation-review-call-for-evidence-summary-ofresponses?preview=4362701#next-steps) section at the end of this public response, DCMS will draw on these findings while continuing to work closely with industry, NCSC, other key Government departments to develop proposed interventions that better enable and encourage organisations to prioritise and invest in effective cyber risk management. 1. Barriers to effective cyber risk management The first part of the Call for Evidence set out DCMS’s understanding of the main barriers to organisations undertaking effective cyber risk management, based on research and engagement undertaken to date. DCMS defined these three barriers as: ¢ Lack of ability, comprising a lack of capacity and knowledge in organisations to manage cyber risk and protect themselves online. ¢ Complexity and insecurity of the digital environment, on the basis of insecure digital products or services in use across organisations and interconnectivity between organisations within and across sectoral and geographic barriers. 6/27