Sectors such as healthcare have a long established culture of gathering and publishing evidence on the efficacy of interventions, and making evidence-based decisions. Cyber security needs an increase in both the supply of and demand for high quality evidence across many best practices, security products, and other interventions. There is no collective Cyber Security evidence base as exists for other sectors and public policy areas, for example under the UK Government What Works Network. NCSC asks, should there be? And what should it look like?