The existing UK regulations reflect law inherited from the EU and are the UK’s only cross-sector cyber security legislation.
The new NIS 2 Directive and other EU regulations are now superseding these and thus the UK needs to urgently update its cybersecurity legislation to avoid being left behind. The aim is to ensure that our infrastructure and economy is not comparably more vulnerable than those of the EU member states.
The Bill will apply to organisations throughout the UK.
It recognises that the UK is facing more sophisticated cyberattacks at increasing frequency. The government notes that essential services and critical infrastructure (areas the NIS 2 Directive also covers) are particularly vulnerable to cyber criminals as evidenced by a vast number of cyberattacks over recent months affecting the NHS, the Ministry of Defence, the British Library, the education sector, and other bodies. These attacks have had severe impacts and pose a significant risk to the economy.
It recognises that the UK is facing more sophisticated cyberattacks at increasing frequency. The government notes that essential services and critical infrastructure (areas the NIS 2 Directive also covers) are particularly vulnerable to cyber criminals as evidenced by a vast number of cyberattacks over recent months affecting the NHS, the Ministry of Defence, the British Library, the education sector, and other bodies. These attacks have had severe impacts and pose a significant risk to the economy.
The government has announced that the Bill will make crucial updates to the legacy regulatory framework by:
- Expanding the remit of the regulation to protect more digital services and supply chains. The government recognises a gap in the UK’s digital defences and aims to prevent similar attacks experienced by critical public services in the UK, such as the recent ransomware attack impacting London hospitals.
- Putting regulators on a strong footing to ensure essential cyber safety measures are being implemented. This would include potential cost recovery mechanisms to provide resources to regulators and providing powers to proactively investigate potential vulnerabilities.
- Mandating increased incident reporting to give government better data on cyberattacks, including where a company has been held to ransom – this will improve our understanding of the threats and alert us to 94 potential attacks by expanding the type and nature of incidents that regulated entities must report.
(The King’s Speech 2024, FINAL – 17/07/24 King’s Speech 2024 background briefing final GOV.uk.docx (publishing.service.gov.uk)).
The bill plays an integral part in ensuring digital security of critical sectors.
It is believed that the current statistics on ransomware attacks do not reflect reality and with this in mind the government is set out to mandate ransomware reporting. If this initiative is successful, mandatory incident reporting will assist the government to collect more accurate data on cyberattacks and improve the understanding of the cyber threats in the UK.
The King’s Speech also addressed the government’s intentions towards establishing legislation to regulate the development of artificial intelligence. Although no specific legislation was referenced in the King’s Speech, this position is noticeably different from the previous government’s approach.
Yes, the Bill is expected to have an impact on UK businesses such as
- Increased reporting requirements
- Greater Power for regulators to ensure adequate security measures are in place
- Business may need to ensure that their suppliers and third-party vendors implement strong cybersecurity practices
- Severe consequences for non-compliance
Want to make sure that your business is ready for the new UK Cyber Bill? Click the button below to discuss your Cyber Essentials or Cyber Essentials Plus Certification.