Question

To ask the Secretary of State for Digital, Culture, Media and Sport, what targets the Cyber Security and Resilience Bill will establish for securing Critical National Infrastructure.

The Cyber Security and Resilience (Network and Information Systems) Bill includes delegated powers that will enable the government, after appropriate consultation, to introduce new security and resilience requirements that regulated entities must meet. Our proposals for these requirements will be consistent with the National Cyber Security Centre’s Cyber Assessment Framework and set clear technical and operational outcomes for security and resilience risk mitigation across in-scope regulated entities. Sectoral NIS regulators must issue guidance on the appropriate and proportionate measures that regulated entities in their sectors should take to meet these requirements.

The Secretary of State will also have the power to designate a Statement of Strategic Priorities. This will set out objectives the regulators will have to work towards when implementing the regime and undertaking regulatory activity, such as issuing guidance.

The Minister for Space, Cyber and Regulatory Reform announced on 26 October 2026 that the Secretary of State will lay a statement, within a year of the Bill’s passage, that will assess whether further Critical National Infrastructure activities should be brought into scope of the NIS Regulations.