Cyber Security and Resilience (Network and Information Systems) Bill

Lord Arbuthnot of Edrom Excerpts

Committee stage
Thursday 3rd September 2026 Grand Committee

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to support these amendments. I have signed all of them, although in doing so I almost got a serious case of electronic RSI. They have the great good fortune of being clear, precise and aligned with existing regulations in other jurisdictions. As my noble friend Lady Harding has already pointed out, many businesses will have operations in multiple jurisdictions. For something as significant as reporting, why would we not follow NIS2 in this respect?

The clarity of the amendments is their strength, even more so when compared with what is currently in the Bill in this respect. What we are trying to achieve from these changes is clear. The 24-hour initial reporting period makes sense: of course it does. As my noble friend Lady Harding pointed out, what one knows at that point is that something is happening and a report is made. In many ways, that is all that needs to be known and all that needs to be reported.

To have a situation as currently set out in the Bill, 24 then 72, means that in that period so much would need to be known to comply with the provisions set out in the Bill that it is just not realistic. This staged approach is both clear and precise. It enables what the purpose of the Bill is all about, which is to support the individual business or entity that is under attack. Crucially, as other noble Lords have said, it puts the power in the collective. As a consequence of one attack, the collective can benefit if there is a sense of commitment to this reporting schedule. That will come only if it is in this stage 4, as clearly set out by my noble friend Lady Harding.

If we want to enable businesses and other entities to really commit to this process—not just be dragged there by force of statute but have it as a means of business as usual, a real cultural change and a commitment to the positivity of this—it has to work for them. This staged process not only does that but, by aligning with NIS, stops this being yet another burden added to business: added unnecessarily and less effectively than what these amendments propose. I very much look forward to the Minister’s response.

[Lord Arbuthnot of Edrom (Con)]

My Lords, good can come out of bad events. The experience, as well as the speech, of my noble friend Lady Harding is one such good aspect. If it combines with bringing us into line with European practice, which so many businesses already have to follow, so much the better. I hope the Minister will be as sympathetic as she possibly can to my noble friend’s amendments.

[Lord Clement-Jones (LD)]

My Lords, I very strongly support this set of amendments on the staged notification of incidents. This is a significant group of amendments from the noble Baroness, Lady Harding, and so well supported by the noble Baroness, Lady Kidron, and the noble Lord, Lord Holmes; he has illustrated this extremely well. As has been described, the noble Baroness, Lady Harding, has a great deal of experience. She brings an invaluable perspective to this Committee, having led a major telecommunications provider through one of the most high-profile corporate cyber breaches in British history. She speaks from real experience and understands very clearly what happens inside an organisation in the immediate aftermath of a severe attack. We should listen extremely carefully to what she has to say.

In those critical opening hours, incident response teams and forensic engineers are working under an intense fog of war, so to speak, actively fighting to contain the malware, to isolate compromised servers and to protect customer data. We cannot expect an organisation to produce an exhaustive, multivariable forensic post-mortem within the first few hours of a fast-moving operational crisis. Yet, as Clause 15 currently stands, the reporting pipeline that follows the initial notification is left thin and unstructured. The noble Baroness’s amendments fix this with three-stage architecture, which is mirrored clause by clause across each category of regulated entity: operators of essential services, data centres, relevant digital service providers and relevant managed service providers.

I will not add much more, as noble Lords have already spoken extremely eloquently. Cyber incidents do not likely conclude on the day a final report falls due. Where an incident is still live at the point that the final report is owed, the entity must instead give a progress report on the information known to date, followed by the final report within one month of the incident ceasing. That seems to me to be a very sensible and realistic accommodation of how live incidents unfold.

Finally, I turn to the amendments tabled by the noble Lord, Lord Ashcombe, although I do not see him here in Committee. They would extend the deadline for the full notification from 72 hours to 30 days. I understand the underlying concerns, as 72 hours can be an unforgiving window in which to complete a full investigation and analysis. However, it is the amendments from the noble Baroness, Lady Harding, that deliver what we need. Intermediate reporting exists precisely so that the authorities are not left in the dark for weeks at a time. Taken together, the noble Baroness’s amendments replace a single blunt deadline with a structured, predictable reporting line, which gives business clarity on exactly what is required and when, while ensuring that the NCSC and our competent authorities receive high-quality, structured intelligence, rather than a single, rushed snapshot. As she said, this is the kind of staged discipline that the EU’s NIS2 directive already reflects and which this Bill should emulate.

--- Later in debate ---

[Lord Arbuthnot of Edrom (Con)]

My Lords, I have added my name to Amendment 167, in the name of the noble Baroness, Lady Ludford, and I also support Amendment 74. I have done that in the knowledge that it is perfectly possible that the Minister will say that she wants to minimise regulation wherever possible—I get that. But I also get that we have been saying for years now that cyber security should be a board responsibility, that it requires knowledge and that that knowledge requires training. That is what Amendment 167 would provide for. We have been saying that, but very little has actually happened. If we are not to legislate about this, what will make people act? If the noble Baroness, Lady Ludford, is right that board ownership of cyber security has declined, we have to do something.

I understand that people who start, say, a wine business or a book business are probably interested in wine or books, rather than cyber security. If they were interested in cyber security, they would probably start a cyber security business, in which they would probably make a great deal more money. But they have to be interested in cyber security in exactly the same way as they have to be interested in money—hence this proposed new clause, which I support.

[Lord Birt (CB)]

My Lords, I strongly support the drift of both amendments spoken to by the noble Baronesses, Lady Kidron and Lady Ludford. As I said the other day, I have sat on many boards with many distinguished people that contained a variety of experience in many jurisdictions, but I have not often come across a board that contains anyone with a pronounced understanding of technology, let alone the extremely narrow but deep area of complexity that is cyber security.

I hope noble Lords will forgive me for reminding the Committee of what I said on Tuesday: the way to achieve this objective is to require boards, at an appropriate level—I do not mean every board in the land—to have a cyber resilience audit each year, in the way that all major organisations have a very searching financial audit each year for the whole board, even though it may contain people who are there for different reasons: they may have marketing or sector expertise. But believe me, for every single board, when the team of auditors—who have been in the business for weeks and sometimes months—reports, it is listened to, and anything it advises is acted upon. We need to do exactly the same for cyber resilience.