Five major changes to the regulation of cybersecurity in the UK under the Cyber Security and Resilience Bill

The article explains five major regulatory shifts arising from the UK’s Cyber Security and Resilience Bill. It notes that the Bill will significantly expand the scope of the NIS Regulations to cover data centers and managed service providers, imposing additional substantive obligations on these organisations. It also states that fines could rise to up to GBP 17m or 4% of worldwide turnover, with expanded powers for competent authorities to share information, issue guidance, and take enforcement action.

A framework is to be created for future changes to the NIS Regulations, alongside mechanisms for competent authorities to impose specific cybersecurity requirements and a greater direction of cybersecurity matters by the Government. The piece places the Bill as the UK’s effort to modernise the NIS framework originally set out in the NIS Directive, noting that NIS Regulations are the UK’s pre-Brexit implementation of that directive and that NIS2 has prompted updates across the EU. It adds that the article’s authors detail five major changes arising from the Bill.