Found: Baroness Lloyd of Effra: Specifically on data centres, the new Cyber Security and Resilience (Network and Information Systems) Bill

Found: Correspondence from Minister for AI and Online Safety, re: Introduction of the Cyber Security and Resilience (Network And Information Systems) Bill

Found: State and Minister for AI and Online Safety on introduction on the Cyber Security and Resilience (Network and Information Systems) Bill

Question to the Department for Energy Security & Net Zero:

To ask the Secretary of State for Energy Security and Net Zero, whether his Department will require a cyber incident database with compulsory fixes to be created for attacks on the energy system.

Answered by Michael Shanks - Minister of State (Department for Energy Security and Net Zero)

The Department for Energy Security and Net Zero takes the security and resilience of UK energy infrastructure extremely seriously, including the cyber security of critical infrastructure. Maintaining a secure and reliable energy supply is a key priority. The Network and Information Systems (NIS) Regulations, impose strict incident-reporting obligations on critical energy operators.

The Government has recently introduced the Cyber Security and Resilience (Network and Information Systems) Bill. The Bill proposes expanding incident-reporting requirements, broadening the scope of reportable events, and enhancing the powers of regulators to oversee compliance and require remedial actions where necessary.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology what assessment her Department has made of the potential impact of the Cyber Security and Resilience (Network and Information Systems) Bill on the EU’s data adequacy decisions in relation to the UK.

Answered by Ian Murray - Minister of State (Department for Science, Innovation and Technology)

The CSR Bill updates the UK’s cyber resilience framework set out in the NIS Regulations 2018 and does not impact the UK's key data protection legislation. It includes a range of measures that affect the Information Commission in its capacity as a NIS regulator, but not its capacity as the UK data protection authority.

The European Commission’s draft decision from 24 June 2025 on UK adequacy concludes that the UK continues to provide an essentially equivalent level of data protection. The government does not consider there to be specific developments that pose substantive risks to the EU adequacy decisions being renewed by the EU’s deadline for adoption of 27 December 2025.

DSIT consulted with the Information Commission during the development of the Bill in accordance with its obligations under Article 36(4) of the General Data Protection Regulation.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, pursuant to the Answer of 25 November 2025 to Question 92210 on Internet: Outages, what assessment she has made of the potential impact of the Cyber Security and Resilience (Network and Information Systems) Bill on disruption to government services during the Cloudflare outage.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

The Department for Science, Innovation and Technology (DSIT) recognises the importance of robust protections for the services essential to our society and economy. That is why we introduced the Cyber Security and Resilience Bill (CSRB) on 12 November - by enhancing protections for the most important digital services, Government services that rely on them will also benefit.

As the digital centre of government, DSIT also recognises that a step change in cyber and digital resilience is required across the government sector. However, we do not need to wait for legislation to take action.

We are acting in parallel with the approach of the CSRB through our mandate to set robust cyber security standards across government organisations. Government services have been subject to the National Cyber Security Centre’s Cyber Assessment Framework since 2022, which promotes resilience against both cyber attacks and the types of system failure that we saw with the Cloudflare outage.

Despite this progress, we are not complacent. DSIT will publish the Government Cyber Action Plan, which will lay out a detailed programme of work with clear expectations, targets, and milestones to enhance Government's cyber and digital resilience.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment she has made of the adequacy of the capacity of (a) sectoral regulators and (b) the NCSC to process and respond to cyber incident reports as a result of the expanded reporting requirements in the Cyber Security and Resilience (Network and Information Systems) Bill.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

Officials have worked closely with regulators and the NCSC in developing the Cyber Security and Resilience Bill and will continue to do so throughout its parliamentary passage and implementation planning.

The NCSC already leads the UK’s response to cyber incidents by triaging reports, supporting affected organisations and coordinating government action during major incidents. In the year preceding, September 2025, NCSC received 1,727 incident tips, 429 of which required direct support. The Bill will expand the type of incidents reported to regulators and the NCSC, strengthening understanding of the threat landscape and improving national cyber-defences.

The Bill will also bolster regulator resources by reforming cost recovery. Currently, regulators are constrained – for example, they cannot recover the cost of enforcement. The Bill will enable regulators to fully recover their costs and utilise flexible, sector-appropriate charging mechanisms, ensuring they are properly equipped to meet their duties.

Found: Cyber Security and Resilience (Network and Information Systems) Bill 2024-26

Found: at their direction without it being registered • introducing the Cyber Security and Resilience (Network and Information Systems) Bill

Found: Cyber Security and Resilience (Network and Information Systems) Bill: supporting documents

Found: Cyber Security and Resilience (Network and Information Systems) Bill: supporting documents

Found: Cyber Security and Resilience (Network and Information Systems) Bill: factsheets

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion

Found: Cyber Security and Resilience (Network and Information Systems) Bill: impact assessment - RPC opinion