93% of organisations made policy changes over the preceding 12 months to address concerns about increased personal liability for CISOs.