Summary#
The Cyber Security and Resilience (Network and Information Systems) Bill would create a new law and amend the Network and Information Systems Regulations 2018. Its stated goal is to improve the security and resilience of systems used for essential activities; that is a goal, not a guaranteed result. The bill is at Lords third reading and is not yet law.
- It would bring some data centre services and large-load controllers into the NIS system as essential services, subject to conditions and definitions.
- It would extend requirements to relevant digital service providers and managed service providers, including security-risk measures and incident reporting.
- It would give enforcement authorities powers to seek information, inspect and investigate, and impose penalties. It also allows authorities to set charges to recover regulatory costs.
- It would let the Secretary of State direct certain organisations to take action about goods, services or facilities linked to a vendor, where the stated risk and necessity conditions are met. Future regulations could also create a mandatory referral scheme for certain transactions.
- It would give the Secretary of State functions relating to AI-related compromises, including obtaining, preserving and analysing information and mitigating their impact.
What it means for you#
- Government and regulators: The Secretary of State must prepare strategic priorities for the regime. Regulatory authorities must have regard to those priorities and seek to achieve relevant objectives. Authorities would have expanded information-gathering and enforcement functions.
- Data centre, digital and managed service providers: Some may become regulated, or face new duties if brought within scope. The bill refers to incident reporting and security measures, but does not set out every threshold or operational detail in the material supplied.
- Organisations dealing with vendors: A direction could require an organisation covered by the bill to act in relation to a vendor’s goods, services or facilities. The bill also allows later regulations to set up a mandatory referral scheme; it does not itself specify which transactions must be referred.
- Customers and the public: The bill includes provision for notifying customers about incidents, but the supplied text does not show the full rules. It does not directly create a general public benefit or guarantee that incidents will be prevented.
- Taxpayers and regulated organisations: Regulatory authorities may charge for their costs under charging schemes. The bill does not state the amounts.
The supplied material does not include the full current NIS Regulations, so the changes could not be checked in detail against all existing rules.
Money#
No cost estimate is available in the supplied material.
- The bill allows regulatory authorities to set charges to recover costs. It does not give amounts or estimates of what organisations may pay.
- The bill enables enforcement penalties, but the supplied extract is incomplete on how all penalty limits are calculated.
- No estimate is given for public spending, staffing needs, or revenue from charges or penalties.
What is unclear#
- Which data centre services and large-load controllers will qualify, and the exact conditions for being regulated.
- Which organisations count as relevant digital or managed service providers, and the precise security and incident-reporting duties they must meet.
- How a vendor direction would be assessed, challenged or reviewed in practice, and which transactions might be covered by a later referral scheme.
- How the bill’s AI-related functions would be used and how they interact with other powers.
- The cost of the new duties and powers, and how charges would be set. The bill allows for later regulations and guidance, but the supplied text does not give their detailed rules.
Case for#
- The bill appears intended to address cyber risks to systems and suppliers that support essential activities. Bringing more types of providers into the regime could give authorities a wider reach.
- Giving regulators powers to investigate suspected failures and require compliance could help them respond to risks that voluntary measures do not address.
- The vendor-direction power could allow the government to act where it considers a vendor-related risk to essential activities serious enough to require action.
- Charges to recover regulatory costs could place some of the cost on regulated organisations rather than leaving it all to public funds.
Case against#
- The bill gives the Secretary of State and regulators significant powers, including directions affecting vendor-related goods and services. The supplied text leaves many details to later regulations.
- It is unclear how affected organisations could challenge a direction or how quickly a decision would have to be made.
- New duties and charges could impose costs on regulated organisations, but the bill gives no estimate of their scale.
- The bill’s broad scope, including its AI-related functions, may be hard to assess until key definitions, thresholds and procedures are set out.