KEY ISSUES FOR DIGITAL TRANSFORMATION IN THE G20

If they have not already done so, G20 economies may wish to consider adhering to the 2015 OECD
Recommendation on Digital Security Risk Management for Economic and Social Prosperity which may offer
useful guidance as governments undertake to develop or revise their national digital security strategy and set
up digital security risk management frameworks. Sharing of best practices would facilitate the development of
these frameworks and their implementation.
G20 economies could take action to encourage SMEs to leverage the opportunities of the digital environment
for their business and at the same time promote good practices to minimise potential adverse effects. While
different types of SMEs face different challenges, all would benefit from integrating digital security risk
management into their business decision making. Increasing SMEs awareness of digital risk and elevating their
capacity to manage it is critical. Given that SMEs may lack expertise and face resource constraints, larger
organisations, industry associations, the technical community and governments can play an important role in
this area and share their knowledge, skills and expertise about best practices in managing digital risk. Useful
approaches could include the development of SME-specific risk management guidance tools and incentives.
While technical experts and policy makers generally agree that digital security risk and privacy concerns are
changing in scale and require urgent action by all stakeholders, the evidence to support this conclusion
remains often anecdotal and qualitative. With some notable exceptions, the available statistics are often not
sufficiently robust to be used with a high degree of confidence for public policy making. While this situation is
typical of an area which, without being completely new, is still at an early stage of maturity, there are also
some complex challenges related to measuring digital security risk, including data breaches. For example,
organisations may be reluctant to disclose quantitative information about vulnerabilities, incidents and impact
to avoid further exposing their reputation or attract malicious actors.
Compared to other areas of digital economy policy, such as telecommunications policy, digital security and
privacy statistics are still in their infancy. However, organisations and business around the world are facing
similar digital risk challenges. There are, therefore, ample opportunities for countries and leaders in public and
private sectors to learn from one another. In order for this mutual learning to take place, there is a need for
agreed upon and consistent terminology and indicators that can be systematically collected and are
comparable over time and across countries. These indicators would help governments and business design and
evaluate policies and risk management strategies, learn from failures and successes, and promote adoption of
good practice.