The UK’s Cyber Security and Resilience Bill will boost standards – and increase costs – Source: www.csoonline.com

If you’re a UK enterprise, this might not be good news: extra investment by infrastructure providers to meet the demands of the government’s forthcoming Cyber Security and Resilience Bill is likely to raise the cost of some services.

This looks like the inevitable outcome of a bill, previewed in a policy statement by the government this week, which will affect a wide tranche of infrastructure companies for the first time. This includes, by the government’s own estimates, up to an additional 1,100 managed service providers, 64 data center operators, and an unspecified number of smaller companies in the digital supply chain.

The government acknowledges that, if implemented in full, this will impose new costs, which means that the business customers using those providers will face higher bills at some point.

Many of these providers are not currently subject to existing cybersecurity legislation governing critical national infrastructure, primarily the Network and Information Systems Regulations 2018 (UK). The new legislation will bring the UK more into line with the regulation’s EU successor, NIS2.

“While we expect this measure to have associated costs related to security improvements and compliance, these investments will position MSPs as trusted and reliable partners in the cyber security landscape,” the government’s policy statement said.

What will the bill change?

As well as broader oversight, the bill will impose tougher reporting requirements, requiring companies to notify the UK’s National Cyber Security Centre (NCSC) of a significant incident within 24 hours. The definition of ‘significant’ will include anything compromising data, as well as, significantly, supply chain attacks affecting customers (stand up Snowflake).

The emphasis on resilience means that providers will have to explain how they would recover from an incident and not simply avoid it. The new regulator of all this, the Information Commissioner’s Office (ICO), will be given teeth, the government indicated. That will mean the ICO will need more resources to meet this expanded, and in many ways, daunting remit.

What this means for enterprises is that the service providers, and probably major data center operators, will have to operate to more consistent standards. Broadly, this is positive, although many will already be working towards those standards under the influence of NIS2 regulations.

Why is it needed?

In 2024, the NCSC responded to 430 cybersecurity incidents, including 89 it said were rated as “nationally significant.” That included the large ransomware attack on the NHS pathology services provider Synnovis last June that ended up costing an estimated £32.7 million ($42 million) to fix.

“Last year’s cyber attack on a supplier to NHS hospitals in London caused more than 11,000 acute outpatient appointments and elective procedures to be postponed. Some of those people will have waited months to be seen,” said the Secretary of State for the Department for Science, Innovation and Technology, Peter Kyle. “I will not allow this to continue. We must take decisive action to deliver effective and enduring change.”

And this isn’t just a problem for the public sector; last year’s Cyber Security Breaches Survey found that half of UK businesses suffered some form of cyberattack in the last 12 months, equivalent to seven million incidents.

To illustrate the peril, the government pointed out that a hypothetical cyber attack directed at an energy company in the southeast of England could “wipe over £49 billion [$63 billion] from the wider UK economy.”

Putting a lid on this kind of disruption requires legislation to compel providers to act, while offering a target to aim for in terms of compliance.

The full demands of the bill have yet to be revealed. Right now, all that affected organizations know is its general outline and broad scope. When it is published in full, the detail will be pored over at length.

“One of the key announcements is the introduction of MSPs falling into the scope of the regulation. Small and medium sized enterprises depend on managed service providers for every aspect of their IT and their security posture,” said David Ferbrache, managing director of UK technology consultancy Beyond Blue. “Making sure MSPs take security seriously can make a massive difference to those SMEs.”

However, Ferbrache was less sure about the new role given to the ICO as regulator. “The extension of the role of the ICO to regulate a wide range of digital services is a major change in scope. Care will be needed to not create conflicts of interest or distract from their key role as our national data protection authority,” he said.