Found: Correspondence from Minister for AI and Online Safety, re: Introduction of the Cyber Security and Resilience (Network And Information Systems) Bill

Found: State and Minister for AI and Online Safety on introduction on the Cyber Security and Resilience (Network and Information Systems) Bill

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, pursuant to the Answer of 25 November 2025 to Question 92210 on Internet: Outages, what assessment she has made of the potential impact of the Cyber Security and Resilience (Network and Information Systems) Bill on disruption to government services during the Cloudflare outage.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

The Department for Science, Innovation and Technology (DSIT) recognises the importance of robust protections for the services essential to our society and economy. That is why we introduced the Cyber Security and Resilience Bill (CSRB) on 12 November - by enhancing protections for the most important digital services, Government services that rely on them will also benefit.

As the digital centre of government, DSIT also recognises that a step change in cyber and digital resilience is required across the government sector. However, we do not need to wait for legislation to take action.

We are acting in parallel with the approach of the CSRB through our mandate to set robust cyber security standards across government organisations. Government services have been subject to the National Cyber Security Centre’s Cyber Assessment Framework since 2022, which promotes resilience against both cyber attacks and the types of system failure that we saw with the Cloudflare outage.

Despite this progress, we are not complacent. DSIT will publish the Government Cyber Action Plan, which will lay out a detailed programme of work with clear expectations, targets, and milestones to enhance Government's cyber and digital resilience.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment she has made of the adequacy of the capacity of (a) sectoral regulators and (b) the NCSC to process and respond to cyber incident reports as a result of the expanded reporting requirements in the Cyber Security and Resilience (Network and Information Systems) Bill.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

Officials have worked closely with regulators and the NCSC in developing the Cyber Security and Resilience Bill and will continue to do so throughout its parliamentary passage and implementation planning.

The NCSC already leads the UK’s response to cyber incidents by triaging reports, supporting affected organisations and coordinating government action during major incidents. In the year preceding, September 2025, NCSC received 1,727 incident tips, 429 of which required direct support. The Bill will expand the type of incidents reported to regulators and the NCSC, strengthening understanding of the threat landscape and improving national cyber-defences.

The Bill will also bolster regulator resources by reforming cost recovery. Currently, regulators are constrained – for example, they cannot recover the cost of enforcement. The Bill will enable regulators to fully recover their costs and utilise flexible, sector-appropriate charging mechanisms, ensuring they are properly equipped to meet their duties.

Found: at their direction without it being registered • introducing the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Cyber Security and Resilience (Network and Information Systems) Bill: supporting documents

Found: Cyber Security and Resilience (Network and Information Systems) Bill: supporting documents

Found: Cyber Security and Resilience (Network and Information Systems) Bill: factsheets

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion