Cyber Security and Resilience (Network and Information Systems) Bill

Key Points

• - Scope expanded: extends NIS duties to MSPs, large data centres, cloud providers and other critical suppliers, plus heightened focus on supply chains and essential services.
• - Incident reporting and information sharing: strengthens incident reporting framework and aims to improve information sharing between regulators and industry; Labour amendments to enable sharing with listed bodies were agreed to, while some proposals for a single, central reporting channel were not adopted.
• - Regulator structure: Labour amendments to designate Ofcom as the sole regulator for the data infrastructure subsector were agreed, removing a joint regulator arrangement that existed in draft form.
• - Governance and oversight: several Liberal Democrat amendments pushed for board-level oversight and periodic testing of security, but these broader governance/testing provisions were defeated at this stage; other ideas sought more resources and scrutiny of regulatory capacity.
• - Alignment and standards: amendments sought clearer alignment with international standards (e.g., NIS2, ISO) and defined boundaries for cloud services; some refinements to cloud definitions and direction rules were agreed.
• - Proposals on sensitive topics: attempts to require a single incident channel, a state-actor risk register, annual progress reports, and reporting on foreign interference were defeated, while related information-sharing and regulatory clarity measures were accepted in part.
• - Measures on SMEs and insurance: debates continued on SME support and the role of cyber insurance, with industry bodies pressing for proportionate duties and practical guidance; some provisions to ease burden while expanding resilience were pursued but not all were adopted.

Progress

The bill is currently at Report Stage in the Commons. It has moved beyond Committee scrutiny, with several Labour-proposed amendments accepted to strengthen information sharing and regulator structure, while many Conservative and Liberal Democrat tactics to impose new reporting channels or broader oversight were not adopted. The bill will continue through Parliament for further consideration and potential passage.