Question

To ask the Secretary of State for Digital, Culture, Media and Sport, whether an independent oversight body evaluates the integrity of standards proposed within the Cyber Security and Resilience Bill.

The Cyber Security and Resilience (Network and Information Systems) Bill does not rely on separate independent oversight body to evaluate standards proposed under the Bill. Instead, the Bill is informed by expertise and provides for appropriate scrutiny through statutory consultation and parliamentary oversight.

The Government proposes to use powers in the Bill to introduce mandatory Security and Resilience Requirements (SRR) in secondary legislation. These proposals will be aligned with the National Cyber Security Centre’s Cyber Assessment Framework (NCSC; CAF) and consistent with international standards and established good practice.

The CAF is owned, developed and maintained by the NCSC, the UK’s technical authority for cyber security, and is widely used by NIS regulators and regulated entities to support the assessment of cyber security and resilience. It is also designed to work alongside international standards. Organisations can use evidence from recognised international standards and frameworks to demonstrate how they meet relevant CAF outcomes. The Government is working closely with the NCSC and regulators in developing the SRR proposals. They will also be subject to consultation and parliamentary scrutiny before coming into force.