Found: egislative Scrutiny T he Committee considered the draft report on the Cyber Security and Resilience (Network and Information Systems) Bill

Found: He was in the House yesterday and spoke in the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Committee also considered a note by the Legal Adviser regarding the Cyber-Security and Resilience (Network and Information Systems) Bill

Found: Baroness Winterton of Doncaster: Are you satisfied with the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Infrastructure operators as a result of the NSS and provisions of the Cyber Security and Resilience (Network and Information Systems) Bill

Found: We welcome the Cyber Security and Resilience (Network and Information Systems) Bill, currently making

Found: That is why we have things like the PSTI and the Cyber Security and Resilience (Network and Information Systems) Bill

Found: That is why we have things like the PSTI and the Cyber Security and Resilience (Network and Information Systems) Bill

Found: professionals, allowing them to focus on economic resilience. 1.4 The Cyber Security and Resilience (Network and Information Systems) Bill

Found: 2026), Courts and Tribunals Bill (first reading 25th February 2026), Cyber Security and Resilience (Network and Information Systems) Bill

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what recent steps he has taken to protect critical national infrastructure from cyber threats.

Answered by Angela Eagle - Secretary of State for Environment, Food and Rural Affairs

The Government is working tirelessly to improve the cyber resilience of our most critical services and systems, including the UK’s Critical National Infrastructure (CNI).

The Cyber Security and Resilience (Network and Information Systems) Bill, currently going through Parliament, will strengthen the UK’s cyber defences to tackle the evolving cyber threats we face. The Bill will protect more essential and digital services from cyber attacks, enable cyber regulators to be more effective, and provide the Government with the flexibility to respond to new threats in the cyber landscape.

In addition, the new Cyber Resilience Index, currently under development, will allow us to monitor progress of interventions against cyber resilience across the CNI landscape, ensuring that they keep pace with the evolving threat.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what assessment he has made of the adequacy of cyber resilience standards among operators of critical national infrastructure.

Answered by Angela Eagle - Secretary of State for Environment, Food and Rural Affairs

The Government is working tirelessly to improve the cyber resilience of our most critical services and systems, including the UK’s Critical National Infrastructure. The Cyber Security and Resilience (Network and Information Systems) Bill will update the existing Network and Information Systems Regulations 2018 to tackle the evolving cyber threats we face. It will protect more essential and digital services from cyber attacks, enable cyber regulators to be more effective, and provide the Government with the flexibility to respond to new threats in the cyber landscape. The Bill has completed its passage through the House of Commons and will move to Second Reading in the House of Lords when parliamentary time allows.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what estimate her Department has made of the compliance costs for small and medium-sized enterprises resulting from the audit and assurance requirements in the Cyber Security and Resilience Bill.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Impact Assessment of the Cyber Security and Resilience (Network and Information Systems) Bill considers the impact on small and medium-sized enterprises. This is available on gov.uk.

The Bill is also explicit that small and micro-sized managed or digital service providers are exempt from being designated as Regulated Managed or Digital Service Providers and can only be regulated if they are designated as critical suppliers, for which there will be a high bar for designation. This is by design, to ensure proportionality.

The government will take a proportionate approach to implementation, including the design of the secondary legislation, which will be consulted on and impact assessed. Small organisations will be able to respond to the consultation, and we welcome their views on these matters. This will be followed by an implementation period and guidance from government and regulators.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what estimate she has made of the resources required for essential service providers to comply with the mandatory incident reporting requirements of the Cyber Security and Resilience Bill.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Impact Assessment of the Cyber Security and Resilience (Network and Information Systems) Bill provides estimates of the additional costs for businesses that will be impacted by the Bill and is available on GOV.UK.

The government is developing further detail on how the incident reporting regime will operate in future implementation proposals and will continue to work closely with regulators and industry to identify opportunities for the streamlining the reporting process. This will support organisations in meeting the improved incident reporting requirements and other duties.

The Bill will require regulators to publish sector-specific guidance to regulated entities to support compliance and address sectoral nuances.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what assessment he has made of the potential impact of the a) National Security Strategy and b) Cyber Security and Resilience (Network and Information Systems) Bill on private sector Critical National Infrastructure operators.

Answered by Dan Jarvis - Minister of State (Home Office) (Security) (Jointly with the Cabinet Office)

The government is working tirelessly with groups across society, including operators of critical national infrastructure, to make the UK a harder target for hostile actors and to deliver growth.

Strategies such as the National Security Strategy 2025, which consolidated several national security reviews and audits including the Resilience Action Plan into one framework, are critical to this work. The government engages with a range of stakeholders, considers assessments and analysis from think-tanks, academics, industry and parliamentary reports, to ensure the ambitions of these strategies are deliverable for industry and other groups across society.

The Cyber Security and Resilience (Network and Information Systems) Bill will strengthen the UK’s cyber defences and ensure the essential and digital services the public relies on are more secure. The government is continuing to engage closely with industry to ensure the Bill is robust and deliverable, and we will consult stakeholders on our plans for secondary legislation in due course. In addition, the Resilience Action Plan included a commitment to map standards across the CNI landscape, which will provide an overview of the resilience requirements placed on CNI sectors and their cumulative impacts.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what consideration she has given to the potential merits of introducing mandatory minimum cyber resilience standards for strategically important firms and supply chains.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Network and Information Systems Regulations 2018 provides the UK’s only cross-sector cyber legislation, focused on protecting the security and resilience of essential services. The regulations impose security duties on Operators of Essential Services (OES) and relevant digital service providers (RDSPs) to take "appropriate and proportionate technical and organisational measures" to manage risk and prevent and minimise the impact of cyber incidents.

The Cyber Security and Resilience (Network and Information Systems) Bill, introduced in November 2025, updates these regulations to ensure it is fit for today, and the future. It will cover a wider range of critically important entities, including data centres and large load controllers and relevant managed service providers (RMSPs). The Bill will also allow, through secondary legislation, for security and resilience requirements to be set for regulated entities. Our proposals for this legislation will be linked to existing, high level security duties and be consistent with the NCSC’s Cyber Assessment Framework.

Regulators will also have the power under the Bill to designate certain suppliers as “critical” if a compromise or outage in their systems can cause a disruption to their services that would have serious, cascading impacts for our society and economy. Proportionate cyber security and resilience duties and requirements to applying to those designated suppliers, with associated requirements will be developed through secondary legislation and guidance. This will ensure that these critical suppliers have the appropriate cyber security and resilience measures in place, helping to protect the UK’s critical infrastructure from disruption.

The Bill sits alongside other regulatory regimes, such as for public telecoms providers and financial services, and a range of other tools to help organisations actively improve their cyber resilience. For example, the government offers the Cyber Essentials certification scheme to prevent the most common cyber attacks. Organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance than those without it.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what steps he is taking to ensure that organisations critical to national security and critical national infrastructure have secure and resilient digital processes and platforms.

Answered by Dan Jarvis - Minister of State (Home Office) (Security) (Jointly with the Cabinet Office)

The government is working tirelessly to improve the cyber resilience of our most critical services and systems, including the UK’s Critical National Infrastructure (CNI).

The Resilience Action Plan, published in July 2025, sets out a strategic ‘all hazards approach’ to building national resilience for the whole of society. The Action Plan includes specific pledges to improve cyber resilience levels of our CNI.

The Cyber Security and Resilience (Network and Information Systems) Bill, currently going through Parliament, will also strengthen the UK’s cyber defences and ensure that the essential and digital services that the public relies upon are more secure.

Found: Cyber Security and Resilience (Network and Information Systems) Bill: HL Bill 32 of 2026–27

Found: The Cyber Security and Resilience (Network and Information Systems) Bill will be carried over from the

Found: public bills: • Armed Forces Bill • Courts and Tribunals Bill • Cyber Security and Resilience (Network and Information Systems) Bill

Found: On 12 November 2025 the Cyber Security and Resilience (Network and Information Systems) Bill (CSRB)

Found: Cyber Security and Resilience (Network and Information Systems) Bill: factsheets

Found: The Cyber Security and Resilience (Network and Information Systems) Bill will update the existing NIS

Found: nis-directive-and-nis-regulations-2018 4 https://www.gov.uk/government/publications/deleted-cyber-security-and-resilience-network-and-information-systems-bill

Found: In November 2025, the government introduced to Parliament the Cyber Security and Resilience (Network and Information Systems) Bill

Found: • Cyber Security and Resilience (Network and Information Systems) Bill: The Bill will strengthen our

Found: On 12 November 2025 the Cyber Security and Resilience (Network and Information Systems) Bill (CSRB)

Found: Schools Bill • Courts and Tribunals Bill • Crime and Policing Bill • Cyber Security and Resilience (Network and Information Systems) Bill

Found: GDPR, UK Data Protection Act 2018, Data (Use and Access) Act 2025, Cyber Security and Resilience (Network and Information Systems) Bill

Found: GDPR, UK Data Protection Act 2018, Data (Use and Access) Act 2025, Cyber Security and Resilience (Network and Information Systems) Bill

Found: industry (Department for Environment, Food and Rural Affairs)9 • the Cyber Security and Resilience (Network and Information Systems) Bill

Found: In November 2025, the government introduced to Parliament the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Letter dated 14/07/2026 from Kanishka Narayan MP to MPs regarding the Cyber Security and Resilience (Network and Information Systems) Bill

Found: • Introduced the Cyber Security and Resilience (Network and Information Systems) Bill into Parliament

Found: No.2) ▪ Sustainable Aviation Fuel Bill SLCM (Memorandum No.3) ▪ Cyber Security and Resilience (Network and Information Systems) Bill

Found: Memoranda have been laid in relation to the Armed Forces Bill, the Cyber Security and Resilience (Network and Information Systems) Bill