Against a backdrop of escalating state-sponsored cyber warfare, the UK Government introduced the Cyber Security and Resilience Bill, a comprehensive legislative overhaul designed to replace the 2018 Network and Information Systems (NIS) Regulations. The Bill aims to close regulatory gaps that have left critical digital supply chains vulnerable to attack. A key feature of the legislation is the expansion of the regulatory perimeter to include "managed service providers" (MSPs) and medium-to-large data centers, recognizing these entities as the "physical vaults of the digital economy". Additionally, the government is granted new powers to designate specific suppliers within essential supply chains as "critical," subjecting them to direct oversight.
The Bill introduces a strict compliance regime that has drawn significant attention from the private sector. In a global first, it mandates the reporting of all ransomware payments and incidents to provide the government with visibility into the cybercrime economy. Furthermore, regulated entities must report significant incidents within 24 hours, and the Secretary of State is granted "active defense powers" to direct companies to take remedial actions against specific vulnerabilities. To ensure compliance, the Bill adopts a penalty structure mirroring the GDPR, with fines reaching the greater of £17 million or 4% of global turnover, alongside a mechanism for regulators to recover the costs of investigations from non-compliant companies.
Source: Gov.UK