Earlier this week, the Department for Science, Innovation and Technology released a detailed policy statement outlining the upcoming Cyber Security and Resilience Bill announced in the King's Speech of July 2024. This legislation represents a significant update to the UK's cyber security regulatory framework, expanding the scope of the Network and Information Systems (NIS) Regulations 2018 and enhancing the powers of regulators to address the increasing threat of cyber-attacks on critical infrastructure and essential services.
For public sector technology professionals, this legislation signals important changes to regulatory compliance, incident reporting, and supply chain security management. This brief provides a concise overview of the key aspects of the proposed legislation and its implications for public sector technology operations.
Why Does This Matter?
The policy statement presents a concerning picture of the UK's cyber threat landscape:
- Hostile cyber activity has grown "more intense, frequent, and sophisticated" with real-world impacts on UK citizens
- A ransomware attack on the NHS last year led to over 11,000 postponed outpatient appointments and procedures
- The 2024 Cyber Breaches Survey reveals more than half of UK businesses reported some form of cyber security breach in the past year
- The NCSC describes the current threat environment as "diffuse and dangerous" with persistent attacks from hostile states and organised crime
The government's assessment is that current resilience is not improving at the rate necessary to keep pace with threats, making this legislative intervention necessary.
Key Measures in the Bill
- Expanded Regulatory Scope
The Bill significantly expands the entities covered by cyber security regulations:
- Managed Service Providers (MSPs) will be brought into scope, with an estimated 900-1,100 MSPs to be secured under the new framework
- Supply chain security will be strengthened, with regulators empowered to designate specific high-impact suppliers as "designated critical suppliers" (DCS), bringing them under comparable obligations as operators of essential services
- Data centres are being considered for inclusion (as an additional measure), recognising their September 2024 designation as Critical National Infrastructure.
- Enhanced Regulatory Powers
Regulators will be given stronger tools to ensure compliance:
- Technical security requirements will be updated and standardised, allowing the Secretary of State to specify appropriate measures through a code of practice and secondary legislation
- Incident reporting will be enhanced with a two-stage reporting structure (24-hour initial notification and 72-hour full report), expanded criteria for reportable incidents, and requirements to simultaneously inform both regulators and the NCSC
- Information gathering powers for the Information Commissioner's Office will be improved, allowing for a more proactive approach to oversight
- Cost recovery mechanisms will be modernised to ensure regulators can effectively fund their regulatory activities
- Future-Proofing the Framework
The Bill introduces measures to ensure the framework remains relevant:
- Delegated powers will enable the Secretary of State to update the regulatory framework without requiring an Act of Parliament, subject to certain safeguards
- A potential Statement of Strategic Priorities is being considered, providing a unified set of objectives and expectations across the twelve regulators and their sectors
- Potential powers of direction for the Secretary of State to direct regulated entities or regulators to take action when necessary for national security
Implications for Public Sector Tech
Immediate Action Points
- Review your organisation's MSP relationships: If your department or agency relies on managed service providers, ensure these providers are aware of the upcoming regulations and prepared to comply.
- Assess supply chain security: Begin documenting critical suppliers and evaluating their cyber security practices, as stronger supply chain duties are coming for operators of essential services.
- Update incident response plans: Prepare for the new two-stage reporting structure that will require notifications within 24 hours of detection and full reports within 72 hours.
- Budget for potential fees: Regulators will have enhanced cost recovery mechanisms, which may result in new fees or charges to regulated entities.
Longer-Term Considerations
- Security standards alignment: The Bill will likely lead to more standardised security requirements across sectors. Begin reviewing the NCSC's Cyber Assessment Framework (CAF) and consider how your organisation can align with both the Basic and Enhanced Profiles.
- Regulatory relationship management: With regulators being given expanded powers, investing in positive and proactive relationships with your sector's regulator will be increasingly important.
- Data centre dependencies: If your department relies on data centres, consider whether your providers will fall within scope (at or above 1MW capacity, or 10MW for enterprise data centres) and what this might mean for service agreements.
- Cross-government coordination: With multiple regulators and a potential Statement of Strategic Priorities, inter-departmental coordination on cyber security matters will become increasingly important.
The Cyber Security and Resilience Bill represents a significant shift in the UK's approach to securing critical infrastructure and essential services. By expanding regulatory scope, enhancing regulator powers, and ensuring the framework can adapt to emerging threats, the government aims to address the vulnerabilities in our cyber defences and improve the resilience of services upon which citizens rely.
For public sector technology professionals, this legislation offers both challenges and opportunities. While compliance requirements will increase, the Bill also promises to create a more secure digital environment that supports stability and growth—ultimately benefiting both government services and the citizens who depend on them.
We will continue to monitor developments in this legislation and provide updates as the Bill progresses through Parliament.