Cyber Security Longitudinal Survey: Wave 4, 2025

<P>Abstract copyright UK Data Service and data collection copyright owner.</P><br><p>The Cyber Security Longitudinal Survey (CSLS) helps us better understand cyber security policies and processes within medium and large businesses and high-income charities. It explores the links over time between these policies and processes and the likelihood and impact of a cyber incident. The survey is commissioned by The Department of Science, Innovation and Technology and aims to support the Government by providing evidence that can inform policies which help to make Britain a safer place to do business online. This is the fourth research year (or wave) of a multi-year study and the data were collected over 2024.</p>
<p>The core objectives of the study are to:</p>
<ul>
<li>explore how and why UK organisations are changing their cyber security profile and how they implement, measure, and improve their cyber defences.</li><li>provide a more in-depth picture of larger organisations, covering topics that are lightly covered in the main Cyber Security Breaches Survey (also available from the UK Data Archive), such as corporate governance, supply chain risk management, internal and external reporting, cyber strategy, and cyber insurance.</li><li>explore the effects of actions adopted by organisations to improve their cyber security on the likelihood and impact of a cyber incident.</li></ul>
<p>Further information and additional publications can be found on the GOV.UK <a href="https://www.gov.uk/government/collections/cyber-security-longitudinal-survey" target="_blank">
Cyber Security Longitudinal Survey</a> pages.</p>
<p>Wave 1-3 data from the Cyber Security Longitudinal Survey can also be found on the UK Data Archive under SNs 8969, 9067 and&nbsp;<span>9284&nbsp;</span><span>respectively.</span></p><br><B>Main Topics</B>:<BR><br><div>The questionnaire covered the following topic areas:</div><div><br></div><ul><li>cyber profile of organisations</li><li>cyber security policies and processes and any improvements made over the last 12 months</li><li>supplier risks</li><li>influencers of changes in policies and processes</li><li>use and forms of cyber insurance</li><li>board engagement with cyber security&nbsp;</li><li>use of information or guidance from the National Cyber Security Centre (NCSC) to inform approach to cyber security</li><li>cyber security incident prevalence, impact and costs</li><li>cyber security incident management</li></ul>