3 ways the UK Government Plans to Tighten Cyber Security Rules with New Bill
AMID A Sharp Spike in Ransomware Attacks Disrupting Essential Services and Critical Infrastructure, The UK Government has set out the Scope of its upcoming cyber security and resilienc bill for the form Time. It aims to patch the holes in the country’s existing cyber regulations and protect critical infrastructure from ransomware and other attack types.
“The cyber security and resilience bill, will help make the uk’s digital economy one of the most secure in the world – giving us the power to protect our services, our suppply chains, and our rights First and most important job of any government, “Technology Secretary Peter Kyle said in a Press release,
On April 1, The Government Released The Cyber security and resilience policy statementOutlining the proposed bill and some additional measures currently under consider. It is expected to be into introduced in parliament laater this year, although no exact implementation timeline has been confirmed.
There are three main faces to the bill: expanding the regulatory scope, strengthening the power of regulators, and allowing the government to make changes at will.
Expanding the regulatory scope
Current Cyber Legislation in the UK has been inherited from the eu and consists of the network and information system (NIS) Regulations 2018. digital infrastructureOnline Marketplaces, Online Search Engines, and Cloud Computing Services. A 2022 review found that they are wildly out of date.
While the eu has updated them, the uk has not, so the cyber security and resilience bill aims to add about 1,000 service providers under his scope. There is a proposed amendment to include data centers, following their design as critical national infrastructure in September.
Impacts of the bill may take time to be realised
William richmond-code, a dispute management partner at freths law firm, thinks that the impacts of the bill may not be felt as quickly as the government May Hope.
He Told Techrepublic in an email: “Even then always organization that the new rules are directed to have the budget, Technical Capability and Leadership Bandwidth to Invest in Updating Their Infrastructure to Meet Current and Future Wave of Cyber Threats, It is Likely to be a time consuming and costly process bringing all of their systems into line. Budget need to be incorporated as rolling commitments – Achieving a Cyber Secure Posture is not a ‘One and Done’.
“Of at least equal importance is the much needed work of getting individuals employed in these nationally important organizations to undersrstand that cyber seconds And that everyone has a role to play in Keeping Such Organizations safe.
“An Emphasis on Top-Down Regulating Change Risks Diluting or distraction from this message, at a point where constant vigilance is required at etc. Increasingly Sophisticated Cyber-Criminals, and Ever More Aggressive Nation-State Actors. “
Strengtheded regulatory power
The cyber security and resilience bill will serve regulators more powerrs to ensure adequate security measures are in place. They would be provided more tools, such as the ability to set and recover fees for regulatory activities and the authority to issue codes of practice and sector-specific guidelines. The Information Commissioner’s Office will have new capability, too, like the power to issue more information notices, allowing it to proactively investigate potential vulnerability.
Increased Mandata Reporting
The new bill will introduce compulsory reporting of a broader range of cyber incidences, include ransomware attacks, to regulators. It is hoped this will ultimately improve government threat intelligence and response strategies.
Instead of just that that interrupt continuity, reportable if you are include that the grinding Availability, and integrity. For example, businesses will need to report if their data confidentiality is compromised or if they fall Victim to a spyware attack that affects their clients.
The bill will require companies to notify their regulator and the national cyber Security Center of a Significant Within 24 Hours of Its Discovery, and Provide An Incident Report with 72 hours. Data centers or firms that provide digital services must also not more affected customers.
Government can make ad hoc changes to the bill
The Technology Secretary will be removed to update the regulatory framework wheemed negaree for necessary for national security, such as by expanding its scope to covers new sector. A proposed amendment would also give the government the power to issue security directions to in-space organizations and regulators during an active cyber threat or incident. This could include Orders to Patch Systems Within A Set Timeframe.
When it comes to enforcement, the policy statement says it will “Consider the precedents set by the telecommunications (Security) Act 2021”. This Legislation allows the government To impose daily penalties of up to £ 100,000 or 10% of the company’s turnover until compliance is achieved.
UK is a hotbed for cyber crime
The uk has experienced a surge in high-profile hacking events over the past year, Including ransomware incidence targeting the British LibrarySupermarkets Sainsbury’s and Morrisons, and Pathology Company SynnovisWhich disrupted the nhs operations. The NCSC Handled 430 Incidents in 2024 Compared to 371 in 2023, and 89 of them was “nationally significant” ransomware incidences threatening essential services or the wider economy.
In December, The Head of the NCSC Warned That The Country’s Cyber Risks are “widely undressed” and that “the defense and resilience of critical infrastructure, Supply Chains, the Public Sector and Aur Wider Economy Must Improve ”to Protect Against Threats.
In January, The UK Government Announced it was considering ransomware payments from public sector bodies and critical industries to make them “unattractive targets for crimCings,” Frequency and Impact of Incidents in the Country. Experts say that critical infrastructure and healthcare sector should be exhempt from bans, as withhlding the ransom and resulting downtime would lead to fatalities.
