Cyber Security and Resilience (Network and Information Systems) Bill

Debate between Baroness Northover and Lord Clement-Jones

Committee stage
Monday 7th September 2026 Grand Committee

[Baroness Northover (LD)]

My Lords, all the amendments that I have put down to the Bill are derived from evidence we received on the National Resilience Select Committee. I am sorry that I was not here last week to address those that came up then, and I am very grateful to my noble friend Lord Clement-Jones for presenting them for me.

Several members of the Select Committee, including me, were in Finland last week looking at its preparedness for attack. Finland has faced the threat from its long border with Russia throughout the history of its country, and its preparedness on a whole-of-society basis is extremely impressive. Although we do not have a long border with Russia to focus our minds, we know that cyber attacks can immediately undermine our whole society and economy. One of the things we heard on our Select Committee is that not only are many companies unprepared for cyber attacks but that there is a shortage of skills in this area.

This amendment is seeking to move things forward. The proposed new clause would

“give the UK Cyber Security Council statutory functions to validate qualifications, to monitor the supply of and demand for cyber security professionals in the areas covered by the Bill, and to audit whether regulated organisations employ certified professionals—a ‘competence mandate’ for the regime”.

I have received some useful information from the sector, which welcomes my attempt to try to ensure that we have sufficient cyber professionals and that there is a mechanism by which they are certified. There are analogies with the certification of medical professionals, for example. Their certification is conducted independently, and I recognise the importance of that. What I am arguing for here is the principle and not necessarily the route suggested by my amendment. How this is best done can be further discussed between Committee and Report.

The National Cyber Security Centre reported that nationally significant cyber incidents have more than doubled in a year. According to its survey, only 7% of UK businesses have formally reviewed the potential cyber security risk presented by their wider supply chain. Evidence to our Select Committee suggests that skills shortages are a key challenge here, especially for SMEs and those in the public sector. It is clear that cyber education, training and apprenticeships, and so on, must accompany these reforms.

The Bill places greater responsibility on organisations to identify and manage cyber risk. However, beyond those technological solutions, these obligations will require skilled professionals to carry them out. The Bill refers to the appointment of a “skilled person” in the context of a national security directive but does not delve into what constitutes a skilled person. I realise that this will change over time, but there should be ways of addressing this.

Neither does the Bill acknowledge the role of skilled persons in delivering its wider objectives. Those in the field have called on the Government to amend the Bill to require organisations to access a cyber security workforce that is qualified to recognise professional standards. We know that this skills shortage exists, weakening our national resilience. One report showed that 87% of organisations experienced at least one consequence due to skills need, so it is becoming strategically important to address this. The Government should use the Bill as an opportunity to professionalise the sector by committing to a cyber security workforce and skills strategy, and mandating that regulators and regulated entities use suitably skilled people for the purposes of compliance with the regulation.

Recognised professional qualifications and certifications anchored in international standards should be required so that we and the regulators are reassured that the work is being carried out to a certain standard. The UK Cyber Security Council was granted royal chartered status to establish a self-regulating, politically independent professional body, structured on proven models of other professional bodies such as the GMC. The UK needs to transition from a fragmented patchwork of varying certifications to a unified national standard of professional competence and ethical conduct.

Therefore, the Bill should recognise the council as the authority for setting and maintaining these standards. Given that the Bill aims to enhance the security and resilience of the UK and the critical sectors that underpin our economy, that needs to be assisted by a suitably skilled workforce to implement it. Of course we need to take further action to make sure that we train people, but this amendment is designed to help move this forward by ensuring that those in this area are sufficiently skilled. I beg to move.

[Lord Clement-Jones (LD)]

My Lords, I was hoping that there would be other contributors—there will be a double-banking on this amendment.

I support Amendment 99, tabled by my noble friend. Throughout our deliberations on this Bill, the Government have placed enormous emphasis on imposing tough, outcomes-based statutory duties on operators and suppliers across our critical infrastructure, but we must confront an uncomfortable truth: we can pass the most sophisticated cyber security regulations in the world but, if our economy lacks the trained, qualified human beings required to design, implement and maintain those defences, those regulations remain completely meaningless. Without a professional workforce capability, this Bill merely codifies what ISC2 has rightly termed “compliance theatre”—an expensive box-ticking exercise that produces mountains of paperwork without making our national networks one bit safer.

Look at the scale of the crisis facing our domestic cyber workforce. In its landmark 2025-26 cyber security workforce study, ISC2 revealed that 52% of UK cyber security professionals identify severe skills shortages as their single greatest barrier to complying with cyber regulations. Further, 58% of organisations reported a critical or significant skills deficit, with an astonishing 87% suffering direct operational consequences from missed system patches and delayed vulnerability remediation to active security oversights. Across the civilian economy, the UK currently faces an 88% shortage of certified cyber practitioners. In an environment of such extreme scarcity, how on earth do the Government expect regulated water utilities, transport operators and medium-sized managed service providers to fulfil the heavy duties created by this Bill?

Amendment 99, from my noble friend, would provide a structural solution to this workforce crisis by placing the UK Cyber Security Council on a formal statutory footing. Crucially, as she explained, this connects directly to the definition of a skilled person under Clause 43. If the Government are serious about raising our national resilience floor, they must recognise that human competence is just as vital as technological hardware. By embedding the UK Cyber Security Council’s competence mandate in primary legislation, Amendment 99 would ensure that our cyber laws are backed by the skilled workforce needed to defend us.

I strongly urge the Minister to accept this amendment. By professionalising our cyber workforce, we would elevate this Bill from more than a compliance exercise to a genuine national capability.

Health and Social Care Bill

Debate between Baroness Northover and Lord Clement-Jones

Tuesday 13th December 2011 Lords Chamber

[Lord Clement-Jones]

My Lords, I thank the Minister for a totally convincing response. The trouble is that it was a response to an amendment that I did not put, although I could have. The amendment which was responded to would have eliminated the OFT from consideration of FT mergers. My amendment was about inserting an additional ground for consideration by the OFT or the Competition Commission, if it went as far as that, so that the public interest was taken into account, as it is in bank mergers nowadays.

I thought that the Minister’s arguments about why the OFT should be involved were wholly convincing—eliminating double jeopardy with the Co-operation and Competition Panel, providing confidence to providers and so on. Mergers are a specialist area. I am sure that the OFT is great at merger consideration. I deliberately did not put down an amendment about the OFT being eliminated from FT mergers—that was the House of Commons amendment to which I referred in the course of my speech.

The noble Baroness’s assertion that the OFT could ensure that patients’ best interests are looked after is precisely my concern. If ordinary merger principles are followed in terms of the OFT looking at the merging of two foundation trusts, I do not believe that it is in law able to take a very close view of what genuinely is in the public interest in terms of provision of a comprehensive National Health Service. I am delighted that the noble Lord, Lord Owen, thought that that was ingenious. Certainly, it seemed to be the logical way to try to get some sense into these foundation trust mergers. Therefore, I very much hope that—

[Baroness Northover]

I do not wish to interrupt my noble friend’s flow. If I have not covered all the areas that he wished to flag up, I will indeed write. However, I made the point that the OFT needed to consider the benefits and the negative sides of mergers in terms of how they would impact on patients. I hope that my noble friend was satisfied at least on that point, even if the leapfrogging and slipping of various amendments from the agenda this evening has tripped me up at this late hour.

[Lord Clement-Jones]

My Lords, we could all be tripped up at this late hour, as, indeed, I was earlier. However, it is a question of what it is possible for the body that is judging the merits of a merger in competition terms to take into account. The reason for including the public interest considerations in the amendment was that the OFT would be extremely limited in the patient considerations that it would be able to take into account. The noble Baroness was pretty sanguine about that. There is still further work to be done in that respect and further consideration needs to be given to the matter. It seems to me that, if nothing else, the question of whether one’s local trust and local foundation hospital will survive as entities is of huge importance to local people and is something that needs to be judged properly with their benefit in mind when the time comes.

Unless I divine that my noble friend is going to give me further guidance or inspiration, I beg leave to withdraw the amendment.

Health and Social Care Bill

Debate between Baroness Northover and Lord Clement-Jones

Tuesday 13th December 2011 Lords Chamber

[Baroness Northover]

I seem to have been inspired. We do not need primary legislation, it seems, we need regulations subject to the affirmative procedure. However, we are consulting on the best approach to using these. I am sure that that informs the noble Lord far better than my earlier answer, but I return to the point that it is extremely important that we get this right, because we certainly do not want to find ourselves in a situation where things are not as well protected as they were in this last instance.

I will now briefly address government Amendment 270A, which is a minor and technical amendment that makes clear that Monitor is concerned with services provided for the purposes of the NHS. On that basis, I hope that noble Lords will be happy to support it and content to withdraw their own amendments.

[Lord Clement-Jones]

My Lords, this is a slightly disparate group of amendments so I will certainly not try to respond on any other amendments apart from my own.

I am grateful to my noble friend the Minister for signposting where patient and public involvement come in, in Clause 59(7) and Clause 178, and her explanation that my amendment would “constrain Monitor’s flexibility”. I am always interested in the kinds of response that the department is able to come up with in these circumstances. After all, HealthWatch and the local healthwatch organisations are the creatures of this Bill and of the department, so it seems somewhat extraordinary that these are not specifically mentioned in Clause 59(7). I understand that in broad terms Monitor has the duty to,

“secure that people who use healthcare services, and other members of the public, are involved to an appropriate degree”—

that is a useful word as well—

“in decisions that Monitor makes about the exercise of its functions”.

However, of course, “appropriate” is determined by Monitor. It is not an objective test in those circumstances.

[Baroness Northover]

I am sorry to interrupt my noble friend, but perhaps I did not make it clear enough that Clause 178 of the Bill allows HealthWatch England to give Monitor advice and provides that Monitor must respond to that.

NHS: Hospital Patient Maltreatment

Debate between Baroness Northover and Lord Clement-Jones

Wednesday 16th March 2011 Lords Chamber

[Baroness Northover]

I thank the noble Baroness for her question. It is clearly in everyone’s interests, especially in this House, to make sure that older people are treated with care and consideration. One thing that comes through from the ombudsman’s report is that this does not apply simply to people who are stuck in hospital, although that is greatly to be regretted and we want to ensure that that does not happen. People in the hospital setting for routine care also are not treated very well. We have to ensure that for whatever reason a person is in hospital they are treated with care and compassion.

[Lord Clement-Jones]

My Lords, the Minister will have been shocked, as were many of us, by the report from Ann Abraham, the health ombudsman, which reported on some very severe cases of maltreatment in the NHS. However, as the noble Baroness, Lady Knight, said, this sort of maltreatment has been going on for many years in the NHS. Is not fundamental change needed in terms of quality, standards, culture, complaints, inspection and reporting? Can the Minister explain how the new NHS reforms will address these?

[Baroness Northover]

I thank the noble Lord for that question. I would point out that the cases highlighted in that report occurred under the previous Administration. But I would not make a party political point here. It is something which we all have to address and we have to ensure that, as we change the NHS, we build in far better ways to ensure that the voices of patients and their families are heard.

There will be the new healthwatch organisations at the local level and the national level. Those organisations will report their concerns to the national board, which will talk to the CQC and advise the Secretary of State. We are hoping to put in place far greater accountability and there will be more local accountability. This is something which we all have to tackle. I note that the Royal College of Nursing has responded positively to this. But the Royal College of Physicians and the Royal College of Surgeons have not yet responded.