KEY ISSUES FOR DIGITAL TRANSFORMATION IN THE G20

The risk related to cybercrime and digital security incidents moved into the top five global business risks in
2015 (in 2014, cyber risks ranked 8th and in 2013 just 15th), according to the fourth annual Allianz Risk
Barometer Survey (Allianz, 2015). In the World Economic Forum’s Global Risks 2015 report, digital risk is
firmly positioned as a major risk in terms of likelihood and effect (WEF, 2015a). It is recognised as one of the
top commercial risks along with geopolitics, the environment, and the economy.
Digital security risk is a concern that the entire business community shares, but it represents an especially
serious threat to smaller businesses. While large businesses and organisations may have the institutional and
financial capacity to develop appropriate digital security risk management, studies in a number of countries
suggest that SMEs, and particularly micro-enterprises, face managerial and financial resource constraints that
make the implementation of digital security risk management practices often a secondary preoccupation.
Data limitations, definitional problems and the lack of appropriate sets of indicators are thus a severe
constraint in measuring digital security and privacy risks today. In particular, for many of the hypothesised
modes by which firms’ “bottom line” might be affected by a digital security incident, there is little or no
available data which is sufficiently robust and comprehensive to be used with a high degree of confidence for
public policy making. Where international surveys exist, they do not take account of how businesses are
managing digital security risks or the effectiveness of digital security risk management practices.
While there is a need to develop new and better metrics to better understand the digital economy, the
security and privacy areas are particularly urgent. The OECD aims to help address this gap by undertaking
work to better measure security and privacy over the 2017-18 period.