Nationwide’s Small Business Owners Survey -- Millennials August 2016 Conducted by Harris Poll

The Small Business Owner Study was conducted online from June 10-23, Respondents comprised 502 U.S. small business owners of companies with less than 300 employees. –Results are weighted to be representative of small business owners in the U.S. –Research participants were drawn from the Harris Poll Online (HPOL) research panel and partner sample. Because the sample is based on those who were invited to participate in the HPOL panel, estimates of theoretical sampling error cannot be calculated. –Percentages were rounded to the nearest whole percent. Differences in the sums of combined categories/answers are due to rounding. Throughout the report, where sample size allowed between relevant subgroups, differences are noted that are statistically significant at the 95% confidence level: Smaller company = <50 employees (n=167) Mid-size company = employees (n=167) Larger company = employees (n=168) Millennials = ages (n=190) Gen X = ages (n=152) Baby Boomers = ages (n=106) 1 Methodology

Medical insurance is the most commonly offered benefit among SBOs at just under half (45%); over one-third (36%) offer paid time off as a benefit to their employees. Two in five SBOs (41%) do not offer benefits. 2 Retirement benefits are offered by one in three small businesses BASE: ALL QUALIFIED EMPLOYEES (n=502) Q700 Which of the following benefits, if any, does your company currently offer to employees? Please select all that apply. Benefits Offered to Employees Larger companies and mid- sized companies are more likely to offer retirement benefits than smaller companies (74% and 67% vs. 17%). Almost 3 in 5 SBOs (58%) offer at least one of the benefits listed, while very few (4%) offer all of the benefits listed. While being most likely to offer retirement benefits (59%), Millennial SBOs are also most likely to offer “any” of these benefits (84%), and most likely to offer “all” (11%).

3 In regard to their business, more SBOs are optimistic about a republican being elected in the upcoming presidential election BASE: ALL QUALIFIED RESPONDENTS (n=502) Q50 How optimistic or pessimistic do you feel about each of the following, in regard to your business? 58% 49% 48% 43% Very/Somewhat Optimistic (NET) About half are optimistic about the overall state of the market (49%) and overall economy (48%) impacting retirement planning and support for their workers. Millennial and Gen X SBOs are more likely than Baby Boomer SBOs to be optimistic if a democrat is elected president (59%, 53% vs. 31%), and Millennial SBOs are most likely to be optimistic of the overall economy and retirement support for their workers (69% vs. 53%, 39%).

4 One in five SBOs feel extremely overwhelmed by the amount of government regulation placed on small businesses BASE: ALL QUALIFIED RESPONDENTS (n=502) Q51 How overwhelmed do you feel by the amount of government regulations placed on small businesses? 38% Extremely/ Very Overwhelmed (NET) Most SBOs are at least somewhat overwhelmed by the regulations placed on them by the government. Smaller companies are more likely than mid-size or larger companies to say they are not at all overwhelmed by the amount of regulations placed on small businesses (26% vs. 12%, 13%). Millennials are the group most overwhelmed (48% vs. 31% Gen Xers, 33% Baby Boomers).

5 Fewer SBOs have a cyber-attack* response plan in place compared to other types of plans BASE: ALL QUALIFIED RESPONDENTS (n=502) Q12 Which of the following types of plans does your company currently have in place? Please select all that apply. Types of Plans Company Currently Has in Place *An attack, via cyberspace, targeting an enterprise’s use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information. Most commonly, small businesses have plans in place to protect customer (42%) and employee (40%) data. Larger companies and mid-size companies are more likely than smaller companies to have a cyber- attack response plan in place (43%, 43% vs. 12%). Only 9% of SBOs have all of these plans in place. More Millennials than Gen X or Baby Boomer SBOs have a cyber-attack response plan in place (42% vs. 17%, 12%).

6 Just over half of SBOs understand cyber insurance policies BASE: ALL QUALIFIED RESPONDENTS (n=502) Q70 How much do you agree or disagree with the following statements regarding insurance? 87% 78% 53% 45% Strongly/ Somewhat Agree (NET) While most understand insurance coverage overall (87%), many have gaps in their business insurance coverage (45%). Millennials are more likely than Gen X or Baby Boomer SBOs to understand insurance coverage (97% vs. 83%, 83%) and cyber insurance policies (79% vs. 51%, 40%). However, they are also more likely to have gaps in their business insurance coverage (62% vs. 43%, 34%).

About four in ten (41%) feel that cyber-attacks happen more frequently to large businesses. 7 Nearly half of SBOs feel cyber-attacks impact large and small businesses equally BASE: ALL QUALIFIED RESPONDENTS (n=502) Q13 In your opinion do cyber-attacks happen more frequently in large businesses, small businesses or both? Cyber-attack Occurrence in Small vs. Large Size Businesses Smaller companies are more likely than mid- size or larger companies to feel that large businesses are more frequently cyber- attacked (46% vs. 34% and 28%), while larger and mid-size companies are more likely to feel that both small and large businesses are are evenly cyber-attacked (29% and 19% vs. 7%). The percentage reporting “evenly in both” is up in 2016 from 38% in Millennial and Gen X SBOs are more likely than Baby Boomers to think cyber-attacks happen more frequently in small businesses (26%, 17% vs. 5%).

One in ten are very concerned about a potential cyber-attack. 8 Over two in three SBOs are at least somewhat concerned about a potential cyber-attack affecting their business BASE: ALL QUALIFIED RESPONDENTS (n=502) Q14 How concerned are you with a potential cyber-attack affecting your business? Level of Concern With a Potential Cyber-Attack on Business 68% Larger and mid-sized companies are more likely to be concerned about potential cyber-attacks than are smaller companies (86%, 88% vs. 59%). Millennials are the most likely to be very concerned about a potential cyber-attack affecting their business (26% vs. 8% Gen X, 7% Baby Boomers).

While half (53%) feel the possibility is not at all likely, 47% admit it is at least somewhat likely they will be affected by a cyber-attack. 9 SBOs are split as to whether they will be affected by a future cyber-attack Base: ALL QUALIFIED RESPONDENTS (n=502) Q23 How likely do you feel your company is to be affected by a future cyber-attack? Likelihood Company Is To Be Affected From Future Cyber-attack 47% Smaller companies are more likely than mid-size or larger companies to believe they are not at all likely to be affected by a future cyber- attack (64% vs. 37% and 25%). “Very likely” is down from 10% in At each generation, fewer SBOs feel their company is likely/very likely to be affected by a future cyber- attack (34% Millennials vs. 17% Gen X vs. 1% Baby Boomers).

Of those who have been affected, six in ten say it took a month or more to recover. 10 The vast majority of small businesses have not been affected by a cyber-attack BASE: ALL QUALIFIED RESPONDENTS (n=502) Q16 Has your company ever been affected by a cyber-attack? Has Company Been Affected by Cyber-Attack Time it Took Company to Recover from Cyber-Attack Larger and mid-size companies are more likely than smaller companies to have been affected by a cyber-attack (17% and 21% vs. 5%). Millennial SBOs are most likely (20%) to have been affected. BASE: ENCOUNTERED CYBER-ATTACK (n=73*) Q17 How long did it take your company to recover from a cyber-attack? *Caution: Small base, results directional in nature

Computer virus Phishing Trojan Horse Hacking Unauthorized access to customer information Unauthorized access to company information Issues due to unpatched software Data breach Ransomware* None of the above While over a third say that they have been the victim to a computer virus (37%), more than two in five (46%) say they have not been attacked. 11 Over half of SBOs admit they have been a victim to at least one type of attack BASE: QUALIFIED RESPONDENTS (n=502) Q19 Have any of the following ever happened to your company? Please select all that apply. Types of Attacks Ever Happen to Company Larger and mid-size companies are more likely than smaller companies to have been a victim of at least one of these types of cyber-attacks (71% and 73% vs. 46%). 54% were victim to at least one type of attack - this is down from 63% in * New in 2016 Fewer SBOs at each generation have been victim to “any” of these cyber-attacks (73% Millennials vs. 53% Gen X vs. 36% Baby Boomers).

Still, seven in ten (71%) say cyber security insurance is too expensive. 12 Most SBOs acknowledge it is increasingly important to keep customers’ data secure to build trust BASE: ALL QUALIFIED RESPONDENTS (n=502) Q24 How much do you agree or disagree with the following statements? Strongly/ Somewhat Agree 88% 71% 66% 64% ** 62% ** 60% * 52% 48% * ** 46% 37% * 28% * * Millennial SBOs agree more than other generations. ** Baby Boomers agree least.

This confidence exists across impact areas that include fixing the breach point technology (72% are at least confident), reputation (74%), and financial (71%) implications. 13 Over seven in ten SBOs are at least confident they could fix and recover from a breach in cyber security BASE: ALL QUALIFIED RESPONDENTS (n=502) Q26 How confident are you that your business could recover in each of the following ways? By recover, we mean return to pre-attack status 71% 72% 74% Confidence That Business Would Recover From Incidents Gen Xers are least likely to feel confident/very confident about financially bouncing back (61% vs. 78% Millennials, 77% Baby Boomers).

14 About half of SBOs are not at all terrified of being a victim of a cyber-attack BASE: ALL QUALIFIED RESPONDENTS (n=502) Q39 How terrified are you that you could be a victim of a cyber-attack? 14% Extremely Terrified/ Terrified (NET) More than one third (37%) say they are somewhat terrified of being a victim of a cyber-attack, while 14% are terrified or extremely terrified. Larger and mid-size companies are more likely than smaller companies to say they are terrified or extremely terrified that they could be the victim of a cyber-attack (34% and 31% vs. 5%). Fear of Being a Victim of a Cyber-Attack Millennials are the group expressing most concern with 18% being extremely terrified, compared to 2% of Gen Xers, and 1% of Baby Boomers).

15 Over half of SBOs have trained employees on what to do if a suspicious message is discovered; how to detect phishing scams BASE: ALL QUALIFIED RESPONDENTS (n=502) Q40 Which of the following, if any, have you trained your employees to do? About half (48%) have trained their employees on how to back up customer information every day to a cloud or hard drive. Two in five have trained employees how to protect business information on mobile devices. About three in four (76%) have trained their employees to implement at least one of these security measures, while only about one in four (24%) have trained employees to take all of these security measures. Training of Employees Gen X and Baby Boomers are more likely to not train their employees on these security measures (25%, 32% vs. 9% Millennials).

16 About a third of SBOs have a disaster recovery plan in place BASE: ALL QUALIFIED RESPONDENTS (n=502) Q12 Which of the following types of plans does your company currently have in place? Please select all that apply. Larger and mid-size companies are more likely than smaller companies to have a disaster recovery plan (55%, 51% vs. 23%). *An attack, via cyberspace, targeting an enterprise’s use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information. Types of Plans Company Currently Has in Place Millennial SBOs are most likely to have a disaster recovery plan in place (51% vs. 30%, 29%). Larger companies, mid-size companies, and Millennial SBOs are most likely to have this type of plan in place.

17 Four in ten SBOs feel that having a written disaster recovery plan is at least important BASE: QUALIFIED RESPONDENTS (n=502); (By Region: East n=104; South n=143; West n=107; Midwest n=77) Q30 How important is it to your business that you have a written disaster recovery plan? About one in 10 feels it is absolutely essential. Still, one in three say it is not important. 41% Importance of a Disaster Recovery Plan Larger and mid-size companies are more likely than smaller companies to feel it is absolutely essential to have a written disaster recovery plan (20%, 28% vs. 6%). Millennial SBOs are most likely to say that having a written disaster recovery plan is absolutely essential to their business (23% vs. 11%, 6%). SBOs in the South are more likely than those in the West to say that having a written disaster plan is at least important (55% vs. 36%)

Nearly all indicate their business would eventually recover. 18 Half of SBOs believe their business would recover from a disaster in less than 3 months BASE: QUALIFIED RESPONDENTS (n=502) Q31 How long do you think it would take your business to recover from a disaster? 49% Smaller companies are most likely to think they would recover in less than 3 months (63% vs. 29%, 27%). With each generation, indication that recovery will occur in less than 3 months increases (24% Millennials vs. 39% Gen X vs. 72% Baby Boomers).