Mark Young, Paul Maynard, and Tomos Griffiths of Covington and Burling write:
The UK Government has announced that it intends to introduce the Cyber Security and Resilience Bill (the “Bill”) to Parliament in 2025. Formally proposed as part of the King’s Speech in July, this Bill is intended to strengthen the UK’s cross-sectoral cyber security legislation to better protect the UK’s economy and infrastructure. This Bill will update the existing NIS Regulations, which derive from EU law. Part of the UK Government’s motivation seems to be to keep pace with updates to EU law in this area, specifically relating to the NIS2 Directive that starts to apply this month (see our blog post on this, here).
A draft of the Bill has not yet been published, but the Government has indicated that this new Bill will, as compared to the existing NIS Regulations:
- Expand the scope of entities captured, “to protect more digital services and supply chains”.
- Impose more stringent reporting requirements on covered entities, including where companies are held to ransom.
- Put regulators on a “stronger footing”, for example by introducing cost recovery mechanisms to ensure regulators are better funded, and providing regulators with the power to proactively investigate potential vulnerabilities.
Read more at Inside Privacy.