Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

Debate between Tim Roca and Lincoln Jopp

Committee stage
Tuesday 3rd February 2026 Public Bill Committees

[Tim Roca]

Q The Committee heard this morning about the public sector’s level of technical debt. This Bill is important in terms of safeguarding essential services, but we heard that an important factor—notwithstanding this Bill—is tackling the enormous number of legacy systems. How do you see us running the two in parallel?

Kanishka Narayan: That is a great question. Broadly, the Bill takes a risk-based and outcomes-focused approach, rather than a technology-specific one. I think that is the right way to go about it. As we have heard today and beyond, there are some areas where frontier technology—new technology such as AI and quantum, which we talked about earlier today—will pose specific risks. There are other areas where the prevalence of legacy systems and legacy database architectures will present particular risks as well.

The Bill effectively says that the sum total of those systems, in their ultimate impact on the risk exposure of an organisation, is the singular focus where regulators should place their emphasis. I would expect that individual regulators will pay heed to the particular prevalence of legacy systems and technical debt as a source of risk in their particular sectors, and as a result to the mitigations that ought to be placed. I think that being technology agnostic is the right approach in this context.

[Lincoln Jopp]

Q Going back to our conversation with the head of IT security and compliance at NHS Greater Glasgow and Clyde and what could be designated an operator of essential services, and our subsequent conversation with Palo Alto, how do you envision that bit of the Bill working? Taking Glasgow as an example, while neither of us are doctors, we both broadly know what happens in hospitals—and there is also a doctor sitting to my right on the Committee, should we need one. On the example that I gave, given what is written in the Bill, how do you think it should work?

Kanishka Narayan: Do you mean operators of essential services, or critical suppliers, as in the third party element?