The UK Govt is currently trying to tighten up regulation online and encourage organisations to plan for cyber attacks. The Bill really seeks to place the defence onus on large scale IT companies working with retailers, industrial or infrastructure companies, plus public sector suppliers. Here’s an extract from the Gov PR;
“Whilst it is for companies to ensure they have proper protections in place, the Bill targets those that will have the maximum impact on improving cyber resilience, bringing the services that retailers, hospitals, councils and others depend on into scope – raising their baseline protects thousands of businesses in the long-term. “
So the Govt is really admitting that the public sector itself is woeful when it comes to cyber security and data breaches. Not good news for those with Govt or NGO contracts, as the blame game will begin as soon as the ransom demand pops up on screens. The synopsis of the Bill is here by the way. Here’s some insurance sector comment;
ABI
Chris Bose, Director of General Insurance Policy at the ABI:
“The introduction of the Cyber Security and Resilience Bill is a vital step in strengthening the UK’s defences against increasingly sophisticated cyber threats. With cyber-attacks costing the UK economy billions each year and disrupting essential services and businesses of all sizes, this legislation will help build resilience across critical infrastructure and supply chains.
Insurance plays a key role in cyber resilience. Our latest data shows nearly £200 million was paid out in cyber claims last year, underlining the scale and severity of the challenge and the support insurers provide when businesses are hit. But cyber insurance is not just a financial safety net. It also helps to put businesses on the front foot, improving their security processes, providing expert advice and helping with incident response planning.
We look forward to working with government and industry to ensure the Bill delivers practical, effective measures that complement risk management strategies and safeguard the UK economy”
NORTON ROSE FULBRIGHT
Tim Jones, cyber security partner at law firm Norton Rose Fulbright adds this:
“Some of these changes will bring the UK’s cybersecurity regime closer to the EU’s NIS2. However, the regimes will not be identical – organisations will need to assess their obligations under each and update their incident notification playbooks.
“They will, naturally, also need to make separate notifications under applicable UK and EU legislation in the event of an incident. The EU Commission may propose a “single-entry point” for fulfilling EU incident notification obligations as part of its digital package on simplification, but notifications under the UK NIS Regulations and other applicable regimes – such as the GDPR – will need to be made separately.”
ASSURED
Here are some thoughts from Nick Harris, CISO at specialist cyber insurance broker Assured, on why the legislation doesn‘t go far enough, with ‘worryingly weak’ evidence.
He says:
“While it’s good to see cyber back on the government’s agenda, this Bill falls short. Recent events suggest the UK’s critical services are still exposed, and the evidence underpinning today’s announcement is seemingly weak. Following the data used by the contracted consultancies, much of the so-called ‘new research’ is outdated and based on US data, going back to 2012 in some cases. In a world where threats evolve by the hour, and where there has been an enormous surge in both ransomware and cyber insurance claims in just the past four months, we can’t rely on building resilience based on old numbers, let alone from another continent.
“The Bill edges us closer to Europe’s NIS2 framework, but entire sectors – from local authorities, waste management and food production – would benefit from being in scope, which is an unfortunate omission. Cyber criminals don’t care what’s in scope and what’s not, and neither should government when it comes to a secure economy across the supply chain. If in-scope companies treat this Bill as a compliance tick-box, this will not provide resilience. Organisations must move beyond this to real risk management, due diligence, and credible cyber insurance cover, to reduce the UK’s vulnerability.”
Be the first to comment