e Lack of commercial rationale, including that organisations find it difficult to demonstrate compelling cases for return on investment on cyber security due to the lack of quantifiable information, including the financial impact, related to cyber attacks!footnote 1] This section of the Call for Evidence tested agreement with the three main barriers outlined; requested insights and evidence on other key barriers to effective cyber risk management; and asked respondents to identify methods that Government or industry could use to address the barriers of inability and complexity and insecurity of the digital environment. The majority of respondents agreed with the three core barriers that were presented in the Call for Evidence. Over 70% of respondents agreed that each of the three barriers presented a moderate or severe barrier to organisations managing their risk effectively: e 72% agreed for inability ¢ 77% agreed for complexity of the digital environment e 71% agreed for a lack of strong commercial rationale. The majority of respondents agreed with each of the 3 barriers outlined Q1: To what extent do you agree that the barriers outlined are the main barriers to organisations undertaking effective cyber risk management? m Strongly agree 32% Cy) 49% m Slightly agree Neither agree or disagree — ° 0 “7 Inability 7% ae Complexity of digital enviornment 11 “Yo meen Lack of a strong commercial rationale “Slightly disagree . yess Base: All who responded; Barrier 1 — Inability (123), Barrier 2 - Complexity of digital environment (121), Barrier 3 — Lack of a strong commercial rationale (122) Other barriers to effective cyber risk management identified by respondents The majority of respondents (79% of 126 who responded) stated that there were other key barriers not captured within the three main barriers outlined, and 87 respondents provided evidence or examples of these additional barriers. DCMS believes that a large proportion of these additional barriers fit within our definition of a lack of ability, complexity and insecurity of the digital environment, and a lack of commercial rationale. However, respondents did highlight two other barriers. These were: 7/27