On July 17th 2024, it was announced at the State Opening of Parliament that the Labour government will introduce the Cyber Security and Resilience Bill (CS&R). The proposed legislation is intended to update the existing Network and Information Security Regulations 2018, known as UK NIS. CS&R will strengthen the UK's cyber defences and resilience to hostile attacks thus ensuring that the infrastructure and critical services relied upon by UK companies are protected by addressing vulnerabilities, while ensuring the

digital economy The digital economy is a portmanteau of digital computing and economy, and is an umbrella term that describes how traditional Brick and mortar, brick-and-mortar economic activities (production, distribution, trade) are being transformed by Interne ...

can deliver growth. The legislation will expand the remit of the existing regulations and put regulators on a stronger footing, as well as increasing the reporting requirements placed on businesses to help build a better picture of cyber threats. Its aim is to strengthen UK cyber defences, ensuring that the critical

infrastructure Infrastructure is the set of facilities and systems that serve a country, city, or other area, and encompasses the services and facilities necessary for its economy, households and firms to function. Infrastructure is composed of public and priv ...

and digital services which companies rely on are secure. The Bill will extend and apply UK-wide. The new laws are part of the Government's pledge to enhance and strengthen UK cyber security measures and protect the digital economy. CS&R will introduce a comprehensive regulatory framework designed to enforce stringent cyber security measures across various sectors. This framework will include mandatory compliance with established cyber security standards and practices to ensure essential cyber safety measures are being implemented. Ultimately, businesses will need to demonstrate their adherence to these standards through regular audits and reporting. Also included in the legislation are potential cost recovery mechanisms to provide resources to regulators and provide powers to proactively investigate potential vulnerabilities.

Keyfacts

The key facts from the King's Speech are:

Consequences

Digital verification services would be established and include " digital identity products to help the public quickly and securely share key information about themselves as they use online services in their everyday life." A National Underground Asset Register would be created enabling "planners and excavators instant, standardised access to pipe and cable data around the country." The Bill will enable the creation of smart data schemes, "which would allow for the secure sharing of customer data, upon their request, with authorised third-party service providers." It will introduce compulsory ransomware reporting so that the authorities can better understand the threat and "alert us to potential attacks by expanding the type and nature of incidents that regulated entities must report." While this information collection is likely to increase resilience to attacks, the administrative burden for businesses from this reporting might well bring with it additional costs as well as the original cyber incident's expense. As modern business practices are interconnected, organisations must ensure that their partners and suppliers also adhere to the standards set by the CS&R. In the EU, the original Network and Information Security Directive (NIS Directive 2016/1148) is being updated to Directive 2022/2555, known as EU NIS 2. EU NIS 2 introduces wide-reaching changes to the existing EU cyber security laws for network and information systems. The CS&R should bring the existing UK NIS regulations 2018 to a framework similar to that of the EU. The Bill as yet has no information on any punishments for non-compliance or what the data regulators' demands from an organisation that has experienced a cyber security incident will be.

Reaction

Jon Ellison, NCSC Director of National Resilience, said that the proposed bill was "a landmark moment tackling the growing threat to the UK's critical systems". He continued that it will be "a crucial step towards a more comprehensive regulatory regime, fit for our volatile world". Former head of the NCSC Ciaran Martin along with other experts welcomed the legislative proposal. On social media, he wrote that the proposed legislation seemed sensible, with mandatory reporting requirements being significant and positive steps. A representative of the CyberUp Campaign Matt Hull said that the organisation is looking forward to the Government updating UK cyber resilience and in particular the Computer Misuse Act 1990. Any updates to this Act would help cyber professionals protect the U.K., safeguard the digital economy and unlock the potential growth within the cybersecurity industry.

Schedule

The Bill will proceed through seven stages of the legislative process which happens in both houses of the UK parliament: first reading, second reading, committee stage, report stage, third reading, opposite house and royal assent. # July 17th Bill announced. # Stage: Pre-legislative Scrutiny (current). # Stage: First reading - yet to be presented.

References

{{Reflist

External links