UK Introduces Cybersecurity and Resilience Legislation

The UK government has unveiled critical cybersecurity legislation aimed at addressing disruptive cyber incidents that threaten essential national infrastructure. Announced Wednesday, the new Cyber Security and Resilience Bill seeks to impose stricter guidelines regarding incident reporting and the management of supply chain vulnerabilities.

“Cybersecurity is national security,” stated Technology Secretary Liz Kendall, emphasizing that this legislation is vital for countering threats to the nation’s way of life. The proposed measures will include a requirement for 900 to 1,100 managed service providers to report incidents and take “proportionate measures” to mitigate cybersecurity risks. Additionally, this bill will classify commercial data centers with a capacity of at least 1 megawatt as “essential services,” paralleling key utilities such as water and electricity, requiring operators to report incidents to both the government and affected customers.

The reporting timeline mandates that critical infrastructure providers must disclose any incidents to the government within 24 hours of awareness, followed by a complete notification within 72 hours. This requirement extends to companies supplying services to critical infrastructure operators and other relevant digital service providers, including major online marketplaces and search engines.

Entities violating these regulations could incur substantial penalties, including daily fines equivalent to 10% of their global revenue. Recent incidents, including a notable hack at Jaguar Land Rover that disrupted production, have underscored the urgent need for enhanced cybersecurity measures. According to a study cited by the government, the average financial impact of a significant cyberattack on UK businesses is estimated at £200,000, contributing to a staggering annual cost of £14.7 billion.

While the Labour government had suggested implementing a ban on ransom payments by critical infrastructure operators, the current version of the bill does not include such a measure, reflecting diverse opinions among security experts regarding its necessity.

As this legislation progresses through the parliamentary process, it will undergo further review in the House of Lords before receiving Royal Assent to become law. The forthcoming measures aim to fortify the cybersecurity landscape across the UK, establishing a more resilient framework against evolving cyber threats. The intent is clear: strengthen defenses, safeguard national interests, and underscore that the UK is not an easy target.

Reporting by Information Security Media Group’s David Perera in Northern Virginia.