Found: egislative Scrutiny T he Committee considered the draft report on the Cyber Security and Resilience (Network and Information Systems) Bill

Found: He was in the House yesterday and spoke in the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Committee also considered a note by the Legal Adviser regarding the Cyber-Security and Resilience (Network and Information Systems) Bill

Found: Baroness Winterton of Doncaster: Are you satisfied with the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Infrastructure operators as a result of the NSS and provisions of the Cyber Security and Resilience (Network and Information Systems) Bill

Found: We welcome the Cyber Security and Resilience (Network and Information Systems) Bill, currently making

Found: That is why we have things like the PSTI and the Cyber Security and Resilience (Network and Information Systems) Bill

Found: That is why we have things like the PSTI and the Cyber Security and Resilience (Network and Information Systems) Bill

Found: professionals, allowing them to focus on economic resilience. 1.4 The Cyber Security and Resilience (Network and Information Systems) Bill

Found: 2026), Courts and Tribunals Bill (first reading 25th February 2026), Cyber Security and Resilience (Network and Information Systems) Bill

Found: highlighted points for the Government to consider during passage of the Cyber Security and Resilience (Network and Information Systems) Bill

Found: The Cyber Security and Resilience (Network and Information Systems) Bill is currently going through

Found: prepare for May Cyber Security and Resilience Bill The Cyber Security and Resilience (Network and Information Systems) Bill

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what recent steps he has taken to protect critical national infrastructure from cyber threats.

Answered by Angela Eagle - Secretary of State for Environment, Food and Rural Affairs

The Government is working tirelessly to improve the cyber resilience of our most critical services and systems, including the UK’s Critical National Infrastructure (CNI).

The Cyber Security and Resilience (Network and Information Systems) Bill, currently going through Parliament, will strengthen the UK’s cyber defences to tackle the evolving cyber threats we face. The Bill will protect more essential and digital services from cyber attacks, enable cyber regulators to be more effective, and provide the Government with the flexibility to respond to new threats in the cyber landscape.

In addition, the new Cyber Resilience Index, currently under development, will allow us to monitor progress of interventions against cyber resilience across the CNI landscape, ensuring that they keep pace with the evolving threat.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what assessment he has made of the adequacy of cyber resilience standards among operators of critical national infrastructure.

Answered by Angela Eagle - Secretary of State for Environment, Food and Rural Affairs

The Government is working tirelessly to improve the cyber resilience of our most critical services and systems, including the UK’s Critical National Infrastructure. The Cyber Security and Resilience (Network and Information Systems) Bill will update the existing Network and Information Systems Regulations 2018 to tackle the evolving cyber threats we face. It will protect more essential and digital services from cyber attacks, enable cyber regulators to be more effective, and provide the Government with the flexibility to respond to new threats in the cyber landscape. The Bill has completed its passage through the House of Commons and will move to Second Reading in the House of Lords when parliamentary time allows.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what estimate her Department has made of the compliance costs for small and medium-sized enterprises resulting from the audit and assurance requirements in the Cyber Security and Resilience Bill.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Impact Assessment of the Cyber Security and Resilience (Network and Information Systems) Bill considers the impact on small and medium-sized enterprises. This is available on gov.uk.

The Bill is also explicit that small and micro-sized managed or digital service providers are exempt from being designated as Regulated Managed or Digital Service Providers and can only be regulated if they are designated as critical suppliers, for which there will be a high bar for designation. This is by design, to ensure proportionality.

The government will take a proportionate approach to implementation, including the design of the secondary legislation, which will be consulted on and impact assessed. Small organisations will be able to respond to the consultation, and we welcome their views on these matters. This will be followed by an implementation period and guidance from government and regulators.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what estimate she has made of the resources required for essential service providers to comply with the mandatory incident reporting requirements of the Cyber Security and Resilience Bill.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Impact Assessment of the Cyber Security and Resilience (Network and Information Systems) Bill provides estimates of the additional costs for businesses that will be impacted by the Bill and is available on GOV.UK.

The government is developing further detail on how the incident reporting regime will operate in future implementation proposals and will continue to work closely with regulators and industry to identify opportunities for the streamlining the reporting process. This will support organisations in meeting the improved incident reporting requirements and other duties.

The Bill will require regulators to publish sector-specific guidance to regulated entities to support compliance and address sectoral nuances.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what assessment he has made of the potential impact of the a) National Security Strategy and b) Cyber Security and Resilience (Network and Information Systems) Bill on private sector Critical National Infrastructure operators.

Answered by Dan Jarvis - Minister of State (Home Office) (Security) (Jointly with the Cabinet Office)

The government is working tirelessly with groups across society, including operators of critical national infrastructure, to make the UK a harder target for hostile actors and to deliver growth.

Strategies such as the National Security Strategy 2025, which consolidated several national security reviews and audits including the Resilience Action Plan into one framework, are critical to this work. The government engages with a range of stakeholders, considers assessments and analysis from think-tanks, academics, industry and parliamentary reports, to ensure the ambitions of these strategies are deliverable for industry and other groups across society.

The Cyber Security and Resilience (Network and Information Systems) Bill will strengthen the UK’s cyber defences and ensure the essential and digital services the public relies on are more secure. The government is continuing to engage closely with industry to ensure the Bill is robust and deliverable, and we will consult stakeholders on our plans for secondary legislation in due course. In addition, the Resilience Action Plan included a commitment to map standards across the CNI landscape, which will provide an overview of the resilience requirements placed on CNI sectors and their cumulative impacts.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what consideration she has given to the potential merits of introducing mandatory minimum cyber resilience standards for strategically important firms and supply chains.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Network and Information Systems Regulations 2018 provides the UK’s only cross-sector cyber legislation, focused on protecting the security and resilience of essential services. The regulations impose security duties on Operators of Essential Services (OES) and relevant digital service providers (RDSPs) to take "appropriate and proportionate technical and organisational measures" to manage risk and prevent and minimise the impact of cyber incidents.

The Cyber Security and Resilience (Network and Information Systems) Bill, introduced in November 2025, updates these regulations to ensure it is fit for today, and the future. It will cover a wider range of critically important entities, including data centres and large load controllers and relevant managed service providers (RMSPs). The Bill will also allow, through secondary legislation, for security and resilience requirements to be set for regulated entities. Our proposals for this legislation will be linked to existing, high level security duties and be consistent with the NCSC’s Cyber Assessment Framework.

Regulators will also have the power under the Bill to designate certain suppliers as “critical” if a compromise or outage in their systems can cause a disruption to their services that would have serious, cascading impacts for our society and economy. Proportionate cyber security and resilience duties and requirements to applying to those designated suppliers, with associated requirements will be developed through secondary legislation and guidance. This will ensure that these critical suppliers have the appropriate cyber security and resilience measures in place, helping to protect the UK’s critical infrastructure from disruption.

The Bill sits alongside other regulatory regimes, such as for public telecoms providers and financial services, and a range of other tools to help organisations actively improve their cyber resilience. For example, the government offers the Cyber Essentials certification scheme to prevent the most common cyber attacks. Organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance than those without it.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what steps he is taking to ensure that organisations critical to national security and critical national infrastructure have secure and resilient digital processes and platforms.

Answered by Dan Jarvis - Minister of State (Home Office) (Security) (Jointly with the Cabinet Office)

The government is working tirelessly to improve the cyber resilience of our most critical services and systems, including the UK’s Critical National Infrastructure (CNI).

The Resilience Action Plan, published in July 2025, sets out a strategic ‘all hazards approach’ to building national resilience for the whole of society. The Action Plan includes specific pledges to improve cyber resilience levels of our CNI.

The Cyber Security and Resilience (Network and Information Systems) Bill, currently going through Parliament, will also strengthen the UK’s cyber defences and ensure that the essential and digital services that the public relies upon are more secure.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment he has made of the adequacy of the Cyber Security and Resilience Bill's incident reporting criteria for capturing novel failure modes arising from autonomous or adaptive machine learning systems in critical national infrastructure.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Cyber Security and Resilience (Network and Information Systems) Bill makes vital updates to the Network and Information Systems (NIS) Regulations 2018 to ensure that providers of the UK’s essential services are reporting more forms of harmful cyber incident to their regulators. Where these incidents meet the threshold of a reportable incident, they will need to be reported to the relevant regulator regardless of the cause. This will include incidents caused by the failure of autonomous or adaptive machine learning systems within a regulated entity’s network and information systems.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment she has made of the potential impact of cyber governance regulations on business growth in (a) Yeovil constituency, (b) Somerset, and (c) England.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Cyber Security and Resilience (Network and Information Systems) Bill was introduced in November 2025 to increase UK defences against cyber attacks. These reforms will ensure the UK economy is better protected than ever by securing the most important essential and digital services and suppliers which businesses and public services rely on.

The Department for Science, Innovation and Technology produced an Impact Assessment for the introduction of the Bill that identifies the expected impact the legislation will have on regulated entities. The assessment highlights that cyber security is a critical enabler of economic growth, and it is expected that the improved security resulting from businesses adhering to the regulations will mean the benefits of adherence outweigh the cost of adherence. Further analysis will be undertaken for relevant secondary legislation to support the implementation of the Bill, and the Impact Assessment will be updated upon Royal Assent.

The government's forthcoming Modernising Corporate Reporting consultation will provide an opportunity for users of corporate reporting to comment on the effectiveness of the existing risk reporting framework which includes businesses' cyber risk reporting and the Department for Business and Trade will consider the impact on business growth of any changes to risk reporting following this consultation.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, with reference to the Cyber Security and Resilience Bill (Network and Information Systems) Bill, a) what estimate she had made of the shortage of the cybersecurity skills which will be necessary to implement and comply with the new regulations created by the Bill and b) what steps the department is taking to address skills gaps.

Answered by Kanishka Narayan - Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)

The Cyber Security and Resilience (Network and Information Systems) Bill was introduced in November 2025 to increase UK defences against cyber attacks. The Bill has been developed in close collaboration with regulators to ensure that they have the right information and tools they need to be supported and effective under the new framework.

This includes allowing regulators to recover all the costs of their activities under the regime so that they can be sufficiently resourced, enhancing their impact through clearer information gateways, and establishing a unified set of objectives so that regulators can better focus their resources. DSIT will also issue clear guidance to support regulators as they exercise their functions and will monitor and evaluate the new framework following its implementation to review the effectiveness of the regime, which could include regulator capability.

New regulated entities being brought into scope of the Bill are in highly technical, high skill sectors and will have guidance and support they can draw from Regulators, Government and NCSC to help them to drive up cyber maturity and effectively manage risks to the essential services they provide. To further support the development of cyber security skills, the £187 million TechFirst programme will fund up to 4,000 students, researchers and innovators entering frontier industries, and help local firms fill around 1,000 tech roles, including cyber security roles.

Found: Cyber Security and Resilience (Network and Information Systems) Bill: HL Bill 32 of 2026–27

Found: The Cyber Security and Resilience (Network and Information Systems) Bill will be carried over from the

Found: public bills: • Armed Forces Bill • Courts and Tribunals Bill • Cyber Security and Resilience (Network and Information Systems) Bill

Found: The Cyber Security and Resilience (Network and Information Systems) Bill 2025, which had its first reading

Found: • Cyber Security and Resilience (Network and Information Systems) Bill: The Bill will strengthen our

Found: Cyber Security and Resilience (Network and Information Systems) Bill: factsheets

Found: The Cyber Security and Resilience (Network and Information Systems) Bill will update the existing NIS

Found: nis-directive-and-nis-regulations-2018 4 https://www.gov.uk/government/publications/deleted-cyber-security-and-resilience-network-and-information-systems-bill

Found: In November 2025, the government introduced to Parliament the Cyber Security and Resilience (Network and Information Systems) Bill

Found: On 12 November 2025, the Government introduced to Parliament the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Schools Bill • Courts and Tribunals Bill • Crime and Policing Bill • Cyber Security and Resilience (Network and Information Systems) Bill

Found: GDPR, UK Data Protection Act 2018, Data (Use and Access) Act 2025, Cyber Security and Resilience (Network and Information Systems) Bill

Found: GDPR, UK Data Protection Act 2018, Data (Use and Access) Act 2025, Cyber Security and Resilience (Network and Information Systems) Bill

Found: industry (Department for Environment, Food and Rural Affairs)9 • the Cyber Security and Resilience (Network and Information Systems) Bill

Found: In November 2025, the government introduced to Parliament the Cyber Security and Resilience (Network and Information Systems) Bill

Found: On 12 November 2025, the Government introduced to Parliament the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Letter dated 14/07/2026 from Kanishka Narayan MP to MPs regarding the Cyber Security and Resilience (Network and Information Systems) Bill

Found: • Introduced the Cyber Security and Resilience (Network and Information Systems) Bill into Parliament

Found: Report on the Legislative Consent Memorandum for the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Senedd Health and Social Services Committee 1 Welsh Government Cyber Security and Resilience (Network and Information Systems) Bill

Found: The Welsh Government’s Legislative Consent Memorandum on the Cyber Security and Resilience (Network and Information Systems) Bill

Found: No.2) ▪ Sustainable Aviation Fuel Bill SLCM (Memorandum No.3) ▪ Cyber Security and Resilience (Network and Information Systems) Bill

Found: business: Consideration of Legislative Consent Memorandum on the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Senedd Health and Social Services Committee 1 Welsh Government Cyber Security and Resilience (Network and Information Systems) Bill

Found: Memoranda have been laid in relation to the Armed Forces Bill, the Cyber Security and Resilience (Network and Information Systems) Bill