10/03/2024 | News release | Distributed by Public on 10/03/2024 12:41
The UK Government has announced that it intends to introduce the Cyber Security and Resilience Bill (the "Bill") to Parliament in 2025. Formally proposed as part of the King's Speech in July, this Bill is intended to strengthen the UK's cross-sectoral cyber security legislation to better protect the UK's economy and infrastructure. This Bill will update the existing NIS Regulations, which derive from EU law. Part of the UK Government's motivation seems to be to keep pace with updates to EU law in this area, specifically relating to the NIS2 Directive that starts to apply this month (see our blog post on this, here).
A draft of the Bill has not yet been published, but the Government has indicated that this new Bill will, as compared to the existing NIS Regulations:
Further detail about the Bill is limited, but the previous Government's response to a consultation on amending the NIS Regulations suggested that:
If the new Labour Government takes inspiration from the EU's NIS2 Directive it could, for example, expand the sectors within scope of the law even further.
The Government has stated that it is "working with key stakeholders to gather input" and will in due course publish further communications on how stakeholders can provide their views on the Bill's content. Once introduced to Parliament, we expect that the Government will look to pass the Bill through the legislative process as quickly as possible. The Government's announcements on the Bill have emphasised its urgency in light of a number of recent high-profile cyber-attacks on important UK institutions. A swift passage could see the Bill becoming law in the first quarter of 2026 (or even sooner), depending on when it is introduced to Parliament.