Found: the National Security Act 2023, the Procurement Act 2023, and the Cyber Security and Resilience (Network and Information Systems) Bill

Found: the National Security Act 2023, the Procurement Act 2023, and the Cyber Security and Resilience (Network and Information Systems) Bill

Found: We will also assess the improvements the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Baroness Lloyd of Effra: Specifically on data centres, the new Cyber Security and Resilience (Network and Information Systems) Bill

Found: Correspondence from Minister for AI and Online Safety, re: Introduction of the Cyber Security and Resilience (Network And Information Systems) Bill

Found: State and Minister for AI and Online Safety on introduction on the Cyber Security and Resilience (Network and Information Systems) Bill

Question to the Department for Science, Innovation & Technology:

To ask His Majesty's Government what assessment they have made of the effectiveness of cybersecurity legislation for AI-associated cyber threats; and what steps they are taking to improve legislation to address those threats.

Answered by Baroness Lloyd of Effra - Baroness in Waiting (HM Household) (Whip)

A range of existing rules already apply to artificial intelligence (AI) systems, such as data protection, competition, equality legislation, and online safety. The Department for Science, Innovation and Technology (DSIT), in close collaboration with the National Cyber Security Centre (NCSC), has created a voluntary Software Security Code of Practice which enables software vendors to secure software at all stages of their lifecycle.

As a government, we have also committed through the AI Action Plan to work with regulators to boost their capabilities, and DSIT and NCSC have taken a leading role in the development of the world's first published global standard for AI cyber security in ETSI (EN 304 223), which sets minimum-security requirements to help secure AI models and systems.

The Cyber Security and Resilience (Network and Information Systems) Bill does not specifically bring large language models or AI companies into scope. However, where organisations in scope of the Bill use AI models and systems, that organisation will need to take appropriate and proportionate steps to manage the risks to these from hackers. This would include large language models which are used as part of the day-to-day software available to staff in a hospital.

The practices recommended to protect against AI-driven cyber threats are essentially the same as those recommended for protecting against “traditional” cyber threats, which are to get good cyber hygiene measures in place, such as using the government’s Cyber Essentials scheme, and managing digital risks by using the Cyber Governance Code of Practice.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment she has made of the potential impact of the Cyber Security and Resilience (Network and Information Systems) Bill on the cyber resilience of energy infrastructure.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

The government's Cyber Security Breaches Survey shows that 43% of UK businesses reported experiencing a cyber breach or attack within the past year. Within the utilities sector this figure is 48%. The survey does not specifically detail cyber attacks on energy infrastructure.

The National Cyber Security Centre (NCSC) has warned there is a significant and enduring cyber threat faced by the UK’s critical national infrastructure. As part of its routine operations the NCSC works closely with all areas of the UK’s critical national infrastructure to highlight the cyber threat landscape and associated mitigation activities. As noted in its Annual Review (2025) the NCSC has undertaken a wide range of activities to enhance protections for the UK’s energy infrastructure, including delivering technical advice and guidance on cyber security challenges, working directly with key suppliers on cyber security initiatives, and providing additional support to operators of renewable energy assets. The annual review also notes how NCSC has deepened its understanding of cyber maturity in critical national infrastructure, enabling more targeted interventions and strengthening the UK’s ability to identify and eliminate sophisticated threat actors.

The Cyber Security and Resilience (Network and Information Systems) Bill updates the Network and Information Systems Regulations 2018, which includes essential services in the energy sector. The Bill will improve the cyber security of the energy sector and its infrastructure through better resourced regulators to respond to cyber threats, and a stronger mechanism for government to set priority outcomes for regulators to work to.

The incident reporting framework will also be updated through the Bill, including for the energy sector. Under the existing reporting regime, too many significant incidents do not need to be reported, and this creates a gap in the government’s knowledge and ability to protect the UK from harm. A wider range of significant incidents, such as successful ransomware and pre-positioning will need to be reported under the Bill. A light touch, initial notification will also be required within 24 hours of an incident being discovered will enable quicker and more effective support to be provided to organisations.

The Bill will keep pace with an increasingly digitalised and interconnected energy sector by bringing load controllers into scope of the NIS Regulations as a new essential service, where they meet the threshold, ensuring regulation is focused where the risk is greatest.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what estimate her Department has made of the number of cyber attacks on energy infrastructure.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

The government's Cyber Security Breaches Survey shows that 43% of UK businesses reported experiencing a cyber breach or attack within the past year. Within the utilities sector this figure is 48%. The survey does not specifically detail cyber attacks on energy infrastructure.

The National Cyber Security Centre (NCSC) has warned there is a significant and enduring cyber threat faced by the UK’s critical national infrastructure. As part of its routine operations the NCSC works closely with all areas of the UK’s critical national infrastructure to highlight the cyber threat landscape and associated mitigation activities. As noted in its Annual Review (2025) the NCSC has undertaken a wide range of activities to enhance protections for the UK’s energy infrastructure, including delivering technical advice and guidance on cyber security challenges, working directly with key suppliers on cyber security initiatives, and providing additional support to operators of renewable energy assets. The annual review also notes how NCSC has deepened its understanding of cyber maturity in critical national infrastructure, enabling more targeted interventions and strengthening the UK’s ability to identify and eliminate sophisticated threat actors.

The Cyber Security and Resilience (Network and Information Systems) Bill updates the Network and Information Systems Regulations 2018, which includes essential services in the energy sector. The Bill will improve the cyber security of the energy sector and its infrastructure through better resourced regulators to respond to cyber threats, and a stronger mechanism for government to set priority outcomes for regulators to work to.

The incident reporting framework will also be updated through the Bill, including for the energy sector. Under the existing reporting regime, too many significant incidents do not need to be reported, and this creates a gap in the government’s knowledge and ability to protect the UK from harm. A wider range of significant incidents, such as successful ransomware and pre-positioning will need to be reported under the Bill. A light touch, initial notification will also be required within 24 hours of an incident being discovered will enable quicker and more effective support to be provided to organisations.

The Bill will keep pace with an increasingly digitalised and interconnected energy sector by bringing load controllers into scope of the NIS Regulations as a new essential service, where they meet the threshold, ensuring regulation is focused where the risk is greatest.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment her Department has made of the potential merits of creating a cyber incident database with compulsory fixes to be created for energy infrastructure.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

The government's Cyber Security Breaches Survey shows that 43% of UK businesses reported experiencing a cyber breach or attack within the past year. Within the utilities sector this figure is 48%. The survey does not specifically detail cyber attacks on energy infrastructure.

The National Cyber Security Centre (NCSC) has warned there is a significant and enduring cyber threat faced by the UK’s critical national infrastructure. As part of its routine operations the NCSC works closely with all areas of the UK’s critical national infrastructure to highlight the cyber threat landscape and associated mitigation activities. As noted in its Annual Review (2025) the NCSC has undertaken a wide range of activities to enhance protections for the UK’s energy infrastructure, including delivering technical advice and guidance on cyber security challenges, working directly with key suppliers on cyber security initiatives, and providing additional support to operators of renewable energy assets. The annual review also notes how NCSC has deepened its understanding of cyber maturity in critical national infrastructure, enabling more targeted interventions and strengthening the UK’s ability to identify and eliminate sophisticated threat actors.

The Cyber Security and Resilience (Network and Information Systems) Bill updates the Network and Information Systems Regulations 2018, which includes essential services in the energy sector. The Bill will improve the cyber security of the energy sector and its infrastructure through better resourced regulators to respond to cyber threats, and a stronger mechanism for government to set priority outcomes for regulators to work to.

The incident reporting framework will also be updated through the Bill, including for the energy sector. Under the existing reporting regime, too many significant incidents do not need to be reported, and this creates a gap in the government’s knowledge and ability to protect the UK from harm. A wider range of significant incidents, such as successful ransomware and pre-positioning will need to be reported under the Bill. A light touch, initial notification will also be required within 24 hours of an incident being discovered will enable quicker and more effective support to be provided to organisations.

The Bill will keep pace with an increasingly digitalised and interconnected energy sector by bringing load controllers into scope of the NIS Regulations as a new essential service, where they meet the threshold, ensuring regulation is focused where the risk is greatest.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment her Department has made of the risk of cyber attacks on energy infrastructure.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

The government's Cyber Security Breaches Survey shows that 43% of UK businesses reported experiencing a cyber breach or attack within the past year. Within the utilities sector this figure is 48%. The survey does not specifically detail cyber attacks on energy infrastructure.

The National Cyber Security Centre (NCSC) has warned there is a significant and enduring cyber threat faced by the UK’s critical national infrastructure. As part of its routine operations the NCSC works closely with all areas of the UK’s critical national infrastructure to highlight the cyber threat landscape and associated mitigation activities. As noted in its Annual Review (2025) the NCSC has undertaken a wide range of activities to enhance protections for the UK’s energy infrastructure, including delivering technical advice and guidance on cyber security challenges, working directly with key suppliers on cyber security initiatives, and providing additional support to operators of renewable energy assets. The annual review also notes how NCSC has deepened its understanding of cyber maturity in critical national infrastructure, enabling more targeted interventions and strengthening the UK’s ability to identify and eliminate sophisticated threat actors.

The Cyber Security and Resilience (Network and Information Systems) Bill updates the Network and Information Systems Regulations 2018, which includes essential services in the energy sector. The Bill will improve the cyber security of the energy sector and its infrastructure through better resourced regulators to respond to cyber threats, and a stronger mechanism for government to set priority outcomes for regulators to work to.

The incident reporting framework will also be updated through the Bill, including for the energy sector. Under the existing reporting regime, too many significant incidents do not need to be reported, and this creates a gap in the government’s knowledge and ability to protect the UK from harm. A wider range of significant incidents, such as successful ransomware and pre-positioning will need to be reported under the Bill. A light touch, initial notification will also be required within 24 hours of an incident being discovered will enable quicker and more effective support to be provided to organisations.

The Bill will keep pace with an increasingly digitalised and interconnected energy sector by bringing load controllers into scope of the NIS Regulations as a new essential service, where they meet the threshold, ensuring regulation is focused where the risk is greatest.

Question to the Department for Energy Security & Net Zero:

To ask the Secretary of State for Energy Security and Net Zero, whether his Department will require a cyber incident database with compulsory fixes to be created for attacks on the energy system.

Answered by Michael Shanks - Minister of State (Department for Energy Security and Net Zero)

The Department for Energy Security and Net Zero takes the security and resilience of UK energy infrastructure extremely seriously, including the cyber security of critical infrastructure. Maintaining a secure and reliable energy supply is a key priority. The Network and Information Systems (NIS) Regulations, impose strict incident-reporting obligations on critical energy operators.

The Government has recently introduced the Cyber Security and Resilience (Network and Information Systems) Bill. The Bill proposes expanding incident-reporting requirements, broadening the scope of reportable events, and enhancing the powers of regulators to oversee compliance and require remedial actions where necessary.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology what assessment her Department has made of the potential impact of the Cyber Security and Resilience (Network and Information Systems) Bill on the EU’s data adequacy decisions in relation to the UK.

Answered by Ian Murray - Minister of State (Department for Science, Innovation and Technology)

The CSR Bill updates the UK’s cyber resilience framework set out in the NIS Regulations 2018 and does not impact the UK's key data protection legislation. It includes a range of measures that affect the Information Commission in its capacity as a NIS regulator, but not its capacity as the UK data protection authority.

The European Commission’s draft decision from 24 June 2025 on UK adequacy concludes that the UK continues to provide an essentially equivalent level of data protection. The government does not consider there to be specific developments that pose substantive risks to the EU adequacy decisions being renewed by the EU’s deadline for adoption of 27 December 2025.

DSIT consulted with the Information Commission during the development of the Bill in accordance with its obligations under Article 36(4) of the General Data Protection Regulation.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, pursuant to the Answer of 25 November 2025 to Question 92210 on Internet: Outages, what assessment she has made of the potential impact of the Cyber Security and Resilience (Network and Information Systems) Bill on disruption to government services during the Cloudflare outage.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

The Department for Science, Innovation and Technology (DSIT) recognises the importance of robust protections for the services essential to our society and economy. That is why we introduced the Cyber Security and Resilience Bill (CSRB) on 12 November - by enhancing protections for the most important digital services, Government services that rely on them will also benefit.

As the digital centre of government, DSIT also recognises that a step change in cyber and digital resilience is required across the government sector. However, we do not need to wait for legislation to take action.

We are acting in parallel with the approach of the CSRB through our mandate to set robust cyber security standards across government organisations. Government services have been subject to the National Cyber Security Centre’s Cyber Assessment Framework since 2022, which promotes resilience against both cyber attacks and the types of system failure that we saw with the Cloudflare outage.

Despite this progress, we are not complacent. DSIT will publish the Government Cyber Action Plan, which will lay out a detailed programme of work with clear expectations, targets, and milestones to enhance Government's cyber and digital resilience.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment she has made of the adequacy of the capacity of (a) sectoral regulators and (b) the NCSC to process and respond to cyber incident reports as a result of the expanded reporting requirements in the Cyber Security and Resilience (Network and Information Systems) Bill.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

Officials have worked closely with regulators and the NCSC in developing the Cyber Security and Resilience Bill and will continue to do so throughout its parliamentary passage and implementation planning.

The NCSC already leads the UK’s response to cyber incidents by triaging reports, supporting affected organisations and coordinating government action during major incidents. In the year preceding, September 2025, NCSC received 1,727 incident tips, 429 of which required direct support. The Bill will expand the type of incidents reported to regulators and the NCSC, strengthening understanding of the threat landscape and improving national cyber-defences.

The Bill will also bolster regulator resources by reforming cost recovery. Currently, regulators are constrained – for example, they cannot recover the cost of enforcement. The Bill will enable regulators to fully recover their costs and utilise flexible, sector-appropriate charging mechanisms, ensuring they are properly equipped to meet their duties.

Found: Cyber Security and Resilience (Network and Information Systems) Bill 2024-26

Found: at their direction without it being registered • introducing the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Cyber Security and Resilience (Network and Information Systems) Bill: supporting documents

Found: Cyber Security and Resilience (Network and Information Systems) Bill: supporting documents

Found: Cyber Security and Resilience (Network and Information Systems) Bill: factsheets

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion

Found: /01/2026 from Kanishka Narayan MP to Hansard Editors regarding the Cyber Security and Resilience (Network and Information Systems) Bill

Found: dated 19/01/2026 from Ian Murray MP to Hansard Editors regarding the Cyber Security and resilience (Network and Information Systems) Bill

Found: CB updated Members with information on the proposed Cyber Security and Resilience (Network and Information Systems) Bill

Found: 1 LEGISLATIVE CONSENT MEMORANDUM Cyber Security and Resilience (Network and Information Systems) Bill

Found: Justice and Constitution Committee to consider and report on the Cyber Security and Resilience (Network and Information Systems) Bill

Found: The Cyber Security and Resilience (Network and Information Systems) Bill 1.

Found: The Welsh Government’s Legislative Consent Memorandum on the Cyber Security and Resilience (Network and Information Systems) Bill

Found: the law since the Commission’s Report was published (such as the Cyber Security and Resilience (Network and Information Systems) Bill