Title page
Contents
Foreword 2
1. Introduction 6
2. Checklist of cybersecurity measurement considerations 8
What should be measured? 8
Interpretability, incentive-compatibility and transparency 10
Data sources 12
3. Cybersecurity data from official sources 15
Official statistical sources 15
Administrative data 20
4. Cybersecurity data from non-official sources 23
Policy surveys and desk research 23
Data from private sources 27
5. Two innovative approaches to measuring uncertainty in cyberspace 33
News reports: towards a cybersecurity uncertainty index 33
Online searches: another approach to constructing an index of cybersecurity uncertainty 39
6. Conclusion 47
References 49
Annex A. Cybersecurity indicators in the OECD ICT Access and Use Databases 55
Annex B. A case study of top related topics 57
Endnotes 58
Table 2.1. Indices versus dashboards 11
Table 3.1. Eurostat's 2022 module on ICT security 16
Table 3.2. Correlations between preventive measures and incidents are likely subject to omitted variable bias 19
Table 4.1. Cybersecurity certifications gap 30
Table 5.1. Alternative search criteria for Le Figaro, the FAZ and The New York Times 34
Table 5.2. Classifying articles based on cyber uncertainty sentiment 37
Table 5.3. Matching nine topic labels with corresponding IDs in Google Trends 41
Table 6.1. Cybersecurity data sources: findings at-a-glance 47
Figure 2.1. Assessing policy impact via inputs, outputs and outcomes 9
Figure 2.2. A schema of cybersecurity data sources 13
Figure 2.3. Stylised amenability of different data sources 14
Figure 3.1. Enterprises that experienced problems due to an ICT-related security incident at least once 17
Figure 3.2. There is often a positive correlation between the share of firms taking action and the propensity to report cybersecurity incidents 18
Figure 4.1. There is limited variation in the ITU's Global Cybersecurity Index across OECD countries 27
Figure 4.2. Uptake of cyber insurance varies significantly across countries 31
Figure 5.1. The FAZ Cyber uncertainty Index 35
Figure 5.2. Cybersecurity uncertainty indices for France, Germany and the United States 36
Figure 5.3. Comparison of different cyber uncertainty indices based on data from the FAZ 38
Figure 5.4. The relationship between Google Trends keywords, topics and categories 41
Figure 5.5. GTCU indices for France, Japan and United States (2010-23) 43
Figure 5.6. Rising related topics to the GTCU index, 2021 45
Boxes
Box 4.1. Quantifying the cybersecurity certifications gap in the United States 30
Annex Tables
Table A.1. Current availability of relevant indicators from the OECD's ICT Access and Use databases 56
Annex Figures
Figure B.1. Most salient top related topics to France's GTCU index from April 2016 to October 2018 57