Draft:Cyber Security and Resilience Bill (2024)

On July 17th 2024, it was announced at the State Opening of Parliament that the Labour government will introduce the Cyber Security and Resilience Bill (CS&R) which is intended to update the existing Network and Information Security (NIS) Regulations 2018. The Bill once passed into law, will strengthen the UK's cyber defences and resilience to hostile attacks to ensure that the infrastructure and critical services relied upon by UK companies are protected by addressing vulnerabilities and ensuring the digital economy can deliver growth. It would expand the remit of existing regulation and put regulators on a stronger footing, as well as increasing the reporting requirements placed on businesses to help build a better picture of cyber threats to the UK. Its purpose is to strengthen the UK’s cyber defences and to ensure that critical infrastructure and the digital services that companies rely on are secure.

The CS&R is part of the government’s pledge to enhance and strengthen the UK’s cyber security measures and protect the digital economy. CS&R will introduce a comprehensive regulatory framework designed to enforce stringent cyber security measures across various sectors. This framework includes mandatory compliance with established cyber security standards and practices. Ultimately, businesses will need to demonstrate their adherence to these standards through regular audits and reporting. The proposed legislation will also put regulators on a strong footing to ensure essential cyber safety measures are being implemented. This would include potential cost recovery mechanisms to provide resources to regulators and provide powers to proactively investigate potential vulnerabilities.

The key facts are (quoting):

"i) The current cyber security regulations play an essential role in safeguarding the UK’s critical national infrastructure by placing security duties on industry involved in the delivery of essential services. The regulations cover five sectors (transport,energy, drinking water, health and digital infrastructure) and some digital services (including online marketplaces, online search engines, and cloud computing services). Twelve regulators (competent authorities) are responsible for implementing the regulations.

ii) Hostile cyber actors are increasingly targeting our critical sectors and supply chains. Recent serious high-profile attacks impacting London hospitals, and the Ministry of Defence as well as ransom attacks on the British Library and Royal Mail, have highlighted that our services and institutions are vulnerable to attack.

iii) The impacts of a cyber attack on these sectors pose severe risks to UK citizens, core services, and the economy at large. For example, as a result of the ransomware attack affecting the NHS in England in June [2024], 3,396 outpatient appointments and 1,255 elective procedures were postponed across King's College Hospital, Guy’s Hospital and St Thomas’ Hospital. The total cost of cyber attacks to the UK was estimated at £27 billion per annum in 2011, this figure is likely to have increased.

iv) The National Cyber Security Centre assess that the increased threat from hostile states and state-sponsored actors continues to ramp up. At a recent speech at CyberUK, National Cyber Security Centre CEO Felicity Oswald warned that providers of essential services in the UK cannot afford to ignore these threats.

v) Two Post-Implementation Reviews found the original regulations are having a positive impact, but that progress has not been fast enough. In 2022, the review found that they ‘are a vital framework in raising wider UK resilience against network and information systems security threats’, but updates are required to keep pace with growing threats. Just over half of operators of essential services have updated or strengthened existing policies and processes since the inception of the [NIS] Regulations in 2018."

It has been estimated that the cost of cybercrime in the UK in 2019 was $65.47 billion (approximately £50 billion).

Consequences

Digital verification services would be established and include "digital identity products to help the public quickly and securely share key information about themselves as they use online services in their everyday life."

A National Underground Asset Register would be created enabling "planners and excavators instant, standardised access to pipe and cable data around the country."

The Bill will enable the creation of 'smart data' schemes, "which would allow for the secure sharing of customer data, upon their request, with authorised third-party service providers."

It will introduce compulsory ransomware reporting so that the authorities can better understand the threat and "alert us to potential attacks by expanding the type and nature of incidents that regulated entities must report."

Lack of Detail

The Bill has no information on any punishments for non-compliance.

The data regulators' demands from an organisation that has experienced a cyber security incident are unclear.

See also

• GDPR - The General Data Protection Regulation.
• Malware - Examples include Computer viruses, spyware and adware.

Further reading

• The Network and Information Systems Regulations 2018.