At the opening of Parliament in July 2024, the UK Government announced its plans for a Cybersecurity and Resilience Bill. Since then, it has been working on putting its idea down so that it can be debated in Parliament. However, the scope of its plans and how it intends to implement the bill have raised questions.
At Infosecurity Europe, Enterprise Times spoke with James Morris OBE, CEO of the CSBR, about the bill and the challenges it faces. The CSBR has recently published a policy note looking at the bill. In this conversation, Morris expands on that note and addresses some other key issues that the bill faces, especially in implementation.
Morris believes that the general approach of the bill makes sense. He said, “It’s very sensible stuff, bringing data centres into critical national infrastructure, managed service providers being part of the regulatory environment, more mandated incident reporting and intelligence about cyber attacks to be shared with the Information Commissioner and to be shared with the National Cyber Security Centre.”
However, alongside that, some issues need addressing. For example, Morris says that the bill is sectoral. That means giving greater powers to the regulators for those sectors to regulate cybersecurity and resilience. But that brings a problem of cohesion and consistency in messaging and enforcement.
One of the key regulators is the UK ICO. Despite its role and remit, its approach to policy has been political and patchy. For example, it chooses not to fine government departments, local and national, for breaches. Even with commercial companies, it is inconsistent in its actions. Morris agrees and says things will get harder for the ICO with this bill.
To hear what else Morris had to say, listen to the podcast.
Where can I get it?
You can listen to the podcast by clicking on the player below. Alternatively, click on any of the podcast services below and go to the Enterprise Times podcast page.
