New legislation will help counter the cyber threat to our essential services
Last week cyber security was unexpectedly thrust into the spotlight by an IT outage which caused significant worldwide disruption. While the incident was not the result of a cyber attack — as the NCSC was quick to establish — it provoked debate in the UK about the resilience of our networks.
A new bill for a growing threat
This brings me to another consequential development in cyber security last week, for the UK at least: the announcement in the King’s Speech that the government intends to bring a Cyber Security and Resilience Bill before Parliament.
For the NCSC, the cyber threat to the services on which we all rely, such as water, power and healthcare, is one which we must continue to urgently address. The scale, pace and complexity of the threat to the critical national infrastructure (CNI) underpinning these vital services is rising. Alongside the threat from ransomware actors we now also see a rise in state and state-aligned groups interested in targeting our CNI.
The announcement of the Cyber Security and Resilience Bill is a landmark moment in tackling this growing threat.
Much accomplished, much still to do
The NCSC, with wider UK government, regulators and industry have together made significant progress against the threat, but not at the pace necessary to match our adversaries. Effective regulation, enforced by capable and well-resourced regulators, is one of government’s most powerful tools to accelerate progress and impose cost on adversaries. The proposed legislation is a crucial step towards a more comprehensive and effective regulatory regime, fit for our volatile world.
Positive legislative change
We have worked with wider government to ensure the proposed changes meet the reality we see in our day-to-day work. The proposed package will make it harder for malicious actors to exploit weak points in CNI supply chains, and will also address some of the common constraints on regulators.
Regulation is not the only way to strengthen the security of our critical systems and we can’t expect this approach to stop every incident. But our collective objective should be to make it as hard as possible for our adversaries to succeed, and to be able to respond and recover well when our defences are breached.
We are seeing a rising threat from adversaries to our CNI. We must be equally bold in our defence. This legislation is a crucial step forward on this journey.
Jon Ellison
NCSC Director of National Resilience
Share and print this article
Written by
