Question

To ask the Secretary of State for Digital, Culture, Media and Sport, how cloud computing providers hosting critical government and commercial data are regulated for business continuity against the risks of failure or disruption.

Large and medium-sized cloud computing providers in the UK are regulated under the Network and Information Systems Regulations 2018, which requires them to manage security and resilience risks and report incidents that have a substantial impact on their service. The Information Commissioner oversees and enforces these requirements.

The Cyber Security and Resilience Bill will strengthen these protections further, including through clearer security and resilience requirements to address evolving cyber threats, and expanded reporting of significant incidents.

The government also intends to introduce a mechanism to bring small and micro cloud computing providers into scope where they are high risk, following consultation. This would ensure regulation is focused where disruption could have the greatest impact.