Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)

Andrew Cooper Excerpts

Committee stage
Tuesday 3rd February 2026 Public Bill Committees

[Lincoln Jopp]

Do either of the other witnesses have anything to say on that?

Jill Broom indicated dissent.

Dr Sanjana Mehta indicated dissent.

[Andrew Cooper (Mid Cheshire) (Lab)]

Q I have a question for Jill Broom. You were talking about the incident reporting requirements. Do you think the legislation strikes the right balance to encourage organisations to come forward when they have been attacked, so that the sector can learn from that and vulnerabilities can be patched out in other areas, or is it so stringent that organisations will be concerned about facing penalties if they are fully transparent?

Jill Broom: I think, again, there is something to be said about the devil being in the detail. A lot is coming with the secondary legislation, so we will learn more about the specifics on incident reporting and penalties that will come into play. There needs to be a balance between those in terms of the risk and the impact. In the Bill itself, there probably need to be some greater safeguards or references to frameworks about how those types of decisions will be made.

[Andrew Cooper]

Q Stuart, you were nodding, which suggests you have something to contribute.

Stuart McKean: It is an interesting cultural challenge. You want people to be open and to report incidents that are having an impact, but at the same time, if they report those incidents they might get fined, which could be economically challenging, particularly for a small business. Yes, we want to open and to report incidents, but—and this is where the detail comes in—what is the level of detail that needs to be reported and what is the impact of reporting it? When you report it to the regulators, what are they going to do with it? How will they share it and how will it benefit everybody else? The devil is definitely in the detail, and it is a cultural change that is required.

[Sarah Russell (Congleton) (Lab)]

Q Obviously no one wants to put crippling costs on to businesses, but cyber-security costs money—there is no way of avoiding that. We only have to look at the JLR attack to see the scale of the impact on our economy when it does not work, and we are looking at only critical national infrastructure here. Have you had any information from business about whether and to what extent this will promote increased spending on cyber-security?

Jill Broom: We can assume that it will, because if you are in the supply chain or come within scope, you will have certain responsibilities and you will have to invest, not just in technology but in the skills space as well. How easy it is to do that is probably overestimated a bit; it is quite difficult to find the right skilled people, and that applies across regulators as well as business.

Generally speaking, yes, I think it will be costly, but there are things that could probably help smaller organisations: techUK has called for things such as financial incentives, or potentially tax credits, to help SMEs. That could be applied on a priority basis, with those working within the critical national infrastructure supply chain looked at first.

Dr Sanjana Mehta: If I may expand on that, we have been consulting our members and the wider community, and 58% of our respondents in the UK say that they still have critical and significant skills needs in their organisations. Nearly half of the respondents—47%—say that skills shortages are going to be one of the greatest hurdles in regulatory compliance. That is corroborated by evidence, even in the impact assessment that has been done on the previous regulatory regime, where I think nearly half of the operators of essential services said that they do not have access to skills in-house to support the regulatory requirements. Continuing to have sustained investment in skills development is definitely going to require funding. Taking it a step back, we need first of all to understand what sort of skills and expertise we have to develop to ensure that implementation of the Bill is successful.

--- Later in debate ---

[Dave Robertson (Lichfield) (Lab)]

Q I have a bit of a blended question. Earlier, Stuart, you said that some of the wording in the Bill says that only 11% of managed service providers are likely to be covered by the legislation, but in previous answers we have heard about skills shortages and where we will need to build those skills. Although I think we all want as many organisations covered as possible, where is the line? Do we currently have enough professionals working in this space to be able to deliver this level of compliance across 11% of MSPs? Given the number of people available for this very specialised work, is the 11% figure in the right ballpark, or do we need to make that wider or thinner to ensure compliance?

It is very easy to write a piece of legislation, but if we do not have the professionals needed to deliver the level of compliance at the thresholds we are setting in this place, that raises other potential issues. Do you have a view about whether the 11% you mentioned is in the right ballpark for the number of professionals we have, or whether it needs to move either way?

Stuart McKean: I am referring to the Government’s report on MSPs that was done a couple of years ago. There are some 12,500 MSPs in the UK. Of those that are in scope of the Bill, 11% are medium-sized and large, but they account for something like 85% of the revenue that MSPs generate in the UK. Proportionally, the larger and medium-sized organisations will have the skillsets needed to deliver the requirements set out in the Bill. As it comes down the supply chain, most managed service providers are suitably qualified to deliver, but they will not be in scope of the Bill. Certainly the critical national infrastructure will not be in that sort of space. We have a good industry, and I think most of the MSPs are in that space, but I would highlight that MSPs are generally IT companies, and cyber-security is not an IT problem. It is much bigger than IT.

Although MSPs can be at one end, this goes back to a question that was asked before about why companies do not just do this anyway, and so be more secure. The reality is that they do not generally understand it; they do not understand the risk and they do not have the qualified people, and it goes on in a sort of vicious circle. A lot of those companies will just go, “Yeah, I’ve got an MSP. They deal with that.” It is an interesting challenge, but, to your question directly, I think medium-sized and large MSPs will not have an issue.

Dr Sanjana Mehta: If I may weigh in on this, I just want to take a step back and comment on the state of the profession in the UK. I appreciate that we are having this discussion specifically in relation to the regulated entities, but there is a broader picture. Parts of the industry are not in scope, but they need to have the right skills as well. We are starting off on a good foundation. The work done by industry, academia and professional associations over the past few years has helped to grow the profession steadily. The report by the Department for Science, Innovation and Technology mentions that the number of cyber-security professionals directly employed in the sector has increased by 11% over the past year.

That said, there is more to be done. I urge the Government to think about the skills piece, not only in relation to the Bill but as a wider challenge. We are very proud of our 10,000-plus members in the UK, who work very hard day and night to secure their organisations despite all the challenges and pressures, but the Bill does give Government a pivotal opportunity to elevate the status of the profession and to professionalise the sector.

[Andrew Cooper]

Q Stuart, as an MSP, you will be familiar with the fact that the large cloud service providers tend to allow you to live failover to different regions. By default you might be hosting in the UK region, but, depending on an outage, you might live failover to the European Union or to the US, depending on the cloud service provider you are using and how it is set up. How does the legislation deal with that and allow you as an MSP to be compliant with it?

Stuart McKean: It is about understanding what your service is delivering. Again, one of the key terms in the Bill is resilience. Needing resilience is a key part of the Bill. Whether you need a service that has international boundaries and you need to fail over to another country will be down to the organisations defining where they want their services to be. If they are happy that they are failed over into the US or another country, that is fine; but the reality is that it will be down to the organisation that has a requirement for a resilient service understanding where its data is. As long as it understands where its data is and what it is asking of the MSP, I am not sure the Bill will cover that as such. It is talking about resilience in general. I do not think it goes into the detail of where your data is.

[Bradley Thomas]

Q Do the witnesses have a view on the benchmarks that, at the moment, do not appear to sit behind the scale of incidents that must be reported? Do you have a view on the absence of any benchmarks and the impact that they may have on smaller firms, or on the risk of over-reporting?

Stuart McKean: Under the designation of a critical supplier, the Bill says:

“any such disruption is likely to have a significant impact on the economy or the day-to-day functioning of society in the whole or any part of the United Kingdom”.

That is a pretty big statement. As a small business owner, how do I know whether what I do is going to have an economic effect on the UK? It will have an economic effect on my business, but whether it has a wider impact is a big statement. I am not sure that it is clear enough.

Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

Andrew Cooper Excerpts

Committee stage
Tuesday 3rd February 2026 Public Bill Committees

[Lincoln Jopp]

Q I want to come back to that point. Chris, you said something like, “SMEs find it very difficult, if not impossible, to bear the regulatory burden, so we have to be very careful when designating SMEs as operators of essential services.” To me, that says that you think the Bill, as currently drafted, will place too much of a regulatory burden on SMEs. Is that correct?

Chris Parker: I was referring to strategic and critical suppliers, which is a list of Government suppliers. We are advocating that the level of governance and regulatory requirement inside an organisation is difficult, and it really is. It requires quite a lot of work and resource, and if we are putting that on to too small a supplier, on the basis that we think it is on the critical path, I would advocate a different system for risk management of that organisation, rather than it being in the regulatory scope of a cyber-resilience Bill. The critical suppliers should be the larger companies. If we start that way in legislation and then work down—the Bill is designed to be flexible, which is excellent—we can try to get that way.

As a last point on flexibility—this is perhaps very obvious to us but less so to people who are less aware of the Bill—there is a huge dynamic going on here where you have a continuum, a line, at one end of which you have the need for clarity, which comes from business. At the other you have a need for flexibility, which quite rightly comes from the Government, who want to adjust and adapt quite quickly to secure the population, society and the economy against a changing threat. That continuum has an opposing dynamic, so the CRB has a big challenge. We must therefore not be too hard on ourselves in finding exactly where to be on that line. Some things will go well, and some will just need to be looked at after a few years of practice—I really believe that. We are not going to get it all right, because of the complexities and different dynamics along that line.

Carla Baker: This debate about whether SMEs should be involved or regulated in this space has been around since we were discussing GDPR back in 2018. It comes down to the systemic nature of the supplier. You can look at the designation of critical dependencies. I am sure you have talked about this, but for example, an SME software company selling to an energy company could be deemed a critical supplier by a regulator, and it is then brought into scope. However, I think it should be the SMEs that are relevant to the whole sector, not just to one organisation. If they are systemic and integral to a number of different sectors, or a number of different organisations within a sector, it is fair enough that they are potentially brought into scope.

It is that risk-based approach again. But if it is just one supplier, one SME, that is selling to one energy company up in the north of England, is it risk-based and proportionate that they are brought into scope? I think that is debatable.

[Andrew Cooper (Mid Cheshire) (Lab)]

Q Carla, I want to come back on the potential for unnecessary over-reporting of incidents. I cannot speak for the Minister, but I am sure it is not his intention that every phishing email is reported. I was listening carefully to what you said about your proposed tiered approach, and I can imagine, say, a situation where you are United Utilities and you intercept somebody trying to put a pre-emptive virus on to one of your industrial control systems. There has been no impact on customers or your infrastructure, because you have caught it. However, I would argue that it is quite important that United Utilities share that information with the regulator and that that information is disseminated to Severn Trent, Thames Water and whoever else needs to know, so they can patch their systems, look out for the virus or find out whether they have been infected already.

I can imagine that the legislation has been worded as it is to try to capture that situation where activity might occur, but not have an impact. Would you accept that that is important, and how would that fit in with the tiered approach that you described?

Carla Baker: I completely get your point. We have looked at that; my legal colleagues have looked at things such as spyware, where you have malware in the system that is not doing anything but is living there, for example, or pre-emptive, where they are waiting to launch an attack, and we think this amendment would still cover those scenarios. It is not necessarily cause and impact: the lights have not gone out, but if there is, for example, a nation state actor in your network, we think the amendment would still cover that.

[Dr Spencer]

Q I would also like to ask some questions on this definition of critical supplier. I know you will have heard the questions I had for the other panel. Is there a danger, in the way this Bill is approaching definitions of critical suppliers, that a supplier may end up being deemed critical solely by virtue of supplying to a critical industry, rather than the criticality of that particular supplier in the ecosystem?

Chris Parker: Yes, absolutely.

Carla Baker: Yes, completely. That is similar to my point, which was probably not explained well enough: how you are deemed critical should be more about your criticality to the entire ecosystem, not just to one organisation.

--- Later in debate ---

[Lincoln Jopp]

Q To be very clear, the three regulators we had here today were the Information Commissioner, Ofgem and Ofcom. If they thought that they had a locus because of something that that hospital did, all three would do the step test, they would come up with their bucket of SMEs that they wanted to bring into scope, and those would be added together and that would be the impact.

Kanishka Narayan: Yes, I guess, added together in the sense that they would be separately regulated, but they would all come within the scope of the regulations. Where there is an overlap in the party being regulated, my hope is that the Bill provides for individual regulation, but is very much open to the prospect of a lead regulator engaging in a softer way with the other regulators, as long as each regulator feels that that has assured them of the risk.

[Andrew Cooper]

Q We have heard evidence today about the appropriateness of individual sectoral regulators being responsible for this, versus a single regulator. Perhaps unsurprisingly, the sectoral regulators were in favour of a sectoral approach, and we heard differing views from other people. The hon. Member for Bromsgrove already covered the point about whether there are sufficient skills available to staff up all the sectoral regulators to the appropriate level to adequately cover this function.

We have heard quite a bit about how important it will be, if taking a sectoral approach, to make sure that sharing information between regulators works smoothly, and that there are no information silos. The witness from Ofcom talked about an annual report to the National Cyber Security Centre. That sent chills down my spine, though I am sure she did not mean it quite in that way. How will you ensure that there is an adequate flow of information between regulators in a timely manner? They might not realise that there is cross-sectoral relevance, but when that information is provided to another regulator, it might turn out that there is. How do you address the importance of a single point of reporting that we heard about time and again from witnesses today?

Kanishka Narayan: Those are really important points. In terms of supporting the quality, frequency and depth of information sharing, first, the Bill provides the legal possibility of doing that in a deeper way. It gives the permission and the ability to do that across regulators.

Secondly, in the light of the implicit expectation of that information sharing, the National Cyber Security Centre already brings together all the relevant regulators for deeper conversation and engagement on areas of overlap, best practice sharing, and particularly the sharing of information related to incidents and wider risk as a result. I hope that will continue to be systematic.

On the question of a single reporting avenue, the National Cyber Security Centre, from an incident and operational point of view, is clearly the primary and appropriate location during the implementation of the Bill. From my conversations with the centre and its conversations with the regulators, I know there has been engagement to ensure that it remains a prompt venue for regulators to feed in their information.

[Andrew Cooper]

Q With respect, Minister, that sounds like quite a lot of, “This is what I hope will happen and this is what I wish to happen.” How will you mandate that it happens? Does there need to be something in the legislation to ensure that there is a duty of candour between regulators?

Kanishka Narayan: The Bill currently says, “We are now giving you the power to be able to do information sharing.” The Bill, as well as other specific bits of wider legislation, has clear expectations on regulators to carry out their regulatory duty. If there appears to be a challenge in the frequency and quality of information sharing, we will of course look at whether we need to go further, but at the moment, giving them substantive permission and the fact that they have clear regulatory responsibilities individually is a very powerful combination.

[The Chair]

I think this might be the last question to the Minister.

Mobile Phones and Social Media: Use by Children

Andrew Cooper Excerpts

Tuesday 20th January 2026 Commons Chamber

[Liz Kendall]

Yes, I have, and I am determined to act swiftly, but there are different views on this issue. The hon. Member will feel very strongly, as do those in her constituency who have contacted her, but the truth is that there are different views that must be heard and listened to, but we will act swiftly.

[Andrew Cooper (Mid Cheshire) (Lab)]

I welcome my right hon. Friend’s statement, particularly the action on mobile phones in schools. Harmful interactions can take place in online games and on instant messaging platforms, and we need to be alive to the risk of driving use to less well-regulated spaces and into virtual private networks. I am also concerned that opaque feed algorithms, which reinforce our worst prejudices and recommend harmful content, can have mental health impacts on adults as well as children. Can she assure me that her review will look at this broader issue, and will she ensure that young people’s voices are at the heart of the consultation?

[Liz Kendall]

I will absolutely look at those issues and make sure that young people’s views and voices are at the heart of this. It is interesting that, when we look at the Australians’ experience, we see that they had to define what social media is and what it covers. That has not been as straightforward as some might have thought, and I think it is really important that we look at it closely. The OSA does not have a definition of social media, so that is one thing we need to consider.

Artificial Intelligence Opportunities Action Plan

Andrew Cooper Excerpts

Monday 13th January 2025 Commons Chamber

[Peter Kyle]

The hon. Gentleman raises an incredibly important point. I assure him that we have a world-class defence industry in this country, world-class defensive capabilities in the Ministry of Defence, and a Government who are determined to ensure that not just digital technology and AI but all evolving technology is used ethically and appropriately in the defence of our nation. I also assure him that the Prime Minister has written to each Government Department asking for their plans on digital progress and safely harnessing the power of digital technology, and that my Department and the Ministry of Defence are in touch.

[Andrew Cooper (Mid Cheshire) (Lab)]

At the risk of disagreeing with some of my colleagues, it is surely Mid Cheshire that is leading the way on AI innovation in the north-west; we have a number of companies working on game-changing applications. Safety Shield Global in Winsford won a King’s award for enterprise for its AI model, which has been 10 years in the making and is keeping construction workers safe on sites all over the world. The action plan talks about the potential of post-industrial constituencies such as mine to act as AI growth zones—key drivers for regional growth. How can areas work with the Government to get AI growth zones up and running, and how soon does he expect them to be operational?

[Peter Kyle]

I am grateful to my hon. Friend for sharing that example from his constituency. In the coming weeks, we will release details of how local communities can get involved and apply to become AI growth zones; I really look forward to seeing his.