<\/p>\n
The newly installed prime minister has dissolved the previously responsible Department for Science, Industry and Technology, with its responsibilities being split among the Cabinet Office with the elevation of a new AI minister, and cyber security transferred to the Departure for Culture, Media and Sport.<\/p>\n
But the move had raised concern among experts \u2013 including James Morris, head of cyber think-tank CSBR, who had warned<\/a> that the move could stall the progress of the Cyber Security and Resilience Bill through the UK parliament. <\/p>\n Morris argued that dividing responsibilities meant cyber threat regulation could lose focus, and Malcolm Dowden<\/a>, a data and technology expert with Pinsent Masons, warned the move posed difficult questions about the impact it might have on cyber legislation <\/p>\n \u201cAndy Burnham\u2019s decision to restructure the departments responsible for the digital economy and AI raises practical questions about continuity in the team responsible for the Cyber Security and Resilience Bill,\u201d he explained.<\/p>\n \u201cThe Bill is prepared for its House of Lords committee stage in September, and there are consultations that were due to be launched over the summer recess on key elements of the Bill. <\/p>\n \u201cThe proposed implementation period for the Bill was already lengthy, stretching into 2029. Any further delay will be a significant concern in view of enhanced threat levels.\u201d<\/p>\n The legislation, unveiled late last year<\/a>, plans to provide existing regulators with powers to enforce larger penalties based on turnover for serious cybersecurity breaches by companies with ties to significant UK critical national infrastructure, building on the existing 2018 Network and Information Systems Regulations.<\/p>\n More stringent reporting requirements would also be introduced for Operators of Essential Services, and various digital service providers \u2013 including a requirement to notify regulators and the National Cyber Security Centre of incidents within the first 24 hours, and full reporting within 72 hours. Tighter triggers for notification \u2013 including near-miss incidents \u2013 are also included within the reporting requirements.<\/p>\n The Bill is due for committee scrutiny from the House of Lords in September, after passing its second reading in the upper chamber earlier this month \u2013 where peers challenged whether the current, diverse regulatory regime was capable of handling cyber security threats.<\/p>\n Lord Birt, former director general of the BBC, was among several voices in the House of Lords<\/a> to question whether a single central regulator was a better approach to monitor cyber resilience in the country.<\/p>\n \u201cThere is a possible vulnerability in every part of this complex network of providers, with many doors to pry open,\u201d Lord Birt said.<\/p>\n \u201cOnce one door is opened by a bad actor\u2014a fraudster, a foreign power, a hacktivist or a ransom gang\u2014there is the potential to explore and disable much or all of the system. \u201cI conclude emphatically that we need a single, focused, dedicated and expert regulator, which I suggest we call the office for cyber resilience \u2013 OCR – to span both the public and private sectors, including organisations and, vitally, those who supply them with the technologies they use. <\/p>\n \u201cFor clarity, the OCR should also regulate the national infrastructure providers.\u201d<\/p>\n Others, including Baroness Harding, agreed with his call, or argued that one of the regulatory bodies overseeing national infrastructure should act as a single lead for the other regulators to streamline the process.<\/p>\n Broader impacts<\/p>\n The Lords\u2019 comments follow concerns from MPs<\/a>\u00a0earlier this year over whether regulators would have both capacity and the technical expertise to manage the cyber security requirements. <\/p>\n
\u201cThis is a highly demanding and ever-changing environment, and it is, frankly, preposterous to suppose that the 12 existing sector-specific regulators of our national infrastructure can acquire and constantly update the knowledge effectively to regulate cyber resilience.<\/p>\n