Cybersecurity Policy Report, U.K. Government Offers New Details About Cyber Legislation, (Apr 1, 2025)
By Tony Foley
The United Kingdom’s Department of Science, Information, and Technology (DSIT) today offered new details about the proposed Cyber Security and Resilience Bill that was originally introduced last year.
In July 2024, the U.K. government asked Parliament to adopt the bill, which, among other provisions, would impose incident reporting obligations on a wide variety of organizations, including those in the critical infrastructure sectors (CPR, July 17, 2024).
In a news release, the government said the proposed bill would boost the cyber defenses of hospitals and energy suppliers as part of its Plan for Change mission. The release noted that the bill was designed to ensure that firms providing essential technology services would no longer be easy targets for cyber criminals.
“Economic growth is the cornerstone of our Plan for Change and ensuring the security of the vital services which will deliver that growth is non-negotiable,” said Peter Kyle, DSIT’s secretary. “Attempts to disrupt our way of life and attack our digital economy are only gathering pace, and we will not stand by as these incidents hold our future prosperity hostage. The Cyber Security and Resilience Bill will help make the UK’s digital economy one of the most secure in the world—giving us the power to protect our services, our supply chains, and our citizens—the first and most important job of any government.”
The policy statement from DSIT sets out the legislative proposals contained in the bill, including the following:
Bringing more entities into the scope of the regulatory framework, including managed service providers, strengthening supply chain security, and enabling regulators to designate “critical suppliers”;
Empowering regulators and enhancing oversight through technological and methodological security requirements, improving incident reporting, improving the information-gathering powers of the Information Commissioner’s Office (ICO), and improving regulators’ cost-recovery mechanisms; and
Ensuring that the regulatory landscape can keep pace with the ever-changing cyber landscape by, among other strategies, delegating powers to ensure that the regulatory environment is adaptable to emerging threats.
The statement outlines several other measures under consideration, including bringing data centers into the scope of the regulatory framework, allowing DSIT to publish a statement of strategic priorities for regulators, and proposing new executive powers for government to enable swift and decisive action in response to cyber threats, including empowering DSIT to direct a regulatory entity to take action in specified circumstances.
In its own policy statement, the National Cyber Security Centre (NCSC) welcomed DSIT’s actions. The NCSC cited several positive developments from adoption of the bill, including broadening the scope of entities covered under existing Network and Information Systems (NIS) regulations (in particular managed service providers), providing more tools for regulators to improve cybersecurity and resilience, giving the government greater flexibility to update the bill’s framework as events warrant, and granting new executive powers to respond to cyber threats when necessary for national security.
“These legislative proposals offer a real opportunity to tackle the increasing acceleration and diversification of cyber threats to UK critical sectors,” said Jonathan Ellison, NCSC’s director–national resilience. “We will work closely with DSIT, colleagues across government, and our partners in industry and the wider cyber ecosystem, as the proposals are further developed and implemented.”
News: InternationalLegislation DataSecurity