Cyber Security and Resilience (Network and Information Systems) Bill (Fourth sitting) 2026-02-05

Welcomed the Committee to discuss Clause 9 which brings large and medium-sized managed service providers into scope of the Network and Information Systems Regulations. Emphasised the importance of regulating MSPs due to their widespread access to clients’ networks and systems, citing a Collins Aerospace incident that highlighted risks. Stated that clause provides definitions for 'managed service' and 'relevant managed service provider', ensuring clarity on organisational inclusion. Noted Clause 10 imposes new duties on MSPs to identify and manage cyber-security risks. Highlighted the importance of considering the latest tools, technologies, techniques, and methods ('regard to the state of the art'). Asserted these provisions strengthen cyber-security across supply chains and reduce vulnerabilities in outsourced IT services.

Acknowledged bringing MSPs into scope is right but emphasised the need for proportionality given different levels of risk among providers despite their size. Highlighted that real risk lies in privileged access and cross-customer dependency rather than just size alone.

Questioned the use of headcount as a metric for defining SMEs in IT, suggesting through-flow of transactions or data could be more relevant. Raised concern that current definitions may not fully capture the scale and impact of digital service providers.

Discussed Clause 9 which brings new categories of technology service providers within scope of NIS regulations. Provided statistics on MSP activity in the UK, indicating around 1,500 to 1,700 medium or large organisations would be regulated. Highlighted their critical role and potential risk due to significant access to client networks and data. Mentioned 86% support from respondents for regulating MSPs as per previous Government consultation.

Sought clarification on the proportion of regulated MSPs in relation to total number of MSPs. Highlighted potential discrepancies between individual organisation numbers and market share proportions.

Questions the Bill's clarity regarding hospital trusts' obligations in case of a reportable event involving an MSP. Concerns that lack of clarity could lead to compliance issues for hospitals.

Concerned about the commercial impacts on MSPs, particularly new contracts and regulatory uncertainty which may render existing frameworks redundant.

Raises concern that micro and small enterprises have been omitted from the legislation due to guidance challenges. Acknowledges their importance in cyber-security but questions whether they can manage overlapping regulatory duties.

There is a real possibility that firms will face issues due to lack of clarity in the Bill. Legal certainty is important as regulatory uncertainty can hinder business decisions and lead to companies assuming they are not regulated entities, which may prevent them from taking necessary actions.

Clarifies the coverage of MSPs under the Bill, stating that 11% by number but 97.6% by revenue are covered. Addresses questions about concentration risk and notification overlap. Emphasises the need for regulatory clarity to prevent unnecessary legal costs.

Questions the Minister regarding factual errors in the impact assessment, specifically the hourly rate of £34 for a contract lawyer. Argues that such figures undermine the credibility of the impact assessment.

Clause 12 should be closely scrutinised as it addresses supply chain risks beyond individual operators. The clause allows regulators to designate suppliers as critical where disruption would significantly affect essential or digital services. However, there is concern about whether the power will be used early and clearly enough to address shared operational technology (OT) risks before they become cross-sector incidents.

The clause is one of the provisions that has given rise to widespread industry concern regarding its scope and implications. It discusses the need for transparency and engagement in the designation process, highlighting concerns about the lack of certainty and potential impact on smaller companies.

This contribution is not fully provided in the transcript excerpt given. Alison Griffiths' position would need to be filled with her full statement if available.

The idea that access to the IT network or system will somehow be discriminatory, or dichotomise between people who are in scope of this measure and people who are not, seems complete nonsense. There is often a focus on doctors but it really is a whole-team effort.

I wonder whether the distinction might be how time-sensitive losing a particular service would be. That is just a suggestion.

There would need to be an arbitration system where a company that is under threat of being designated a critical supplier could have a discussion or debate about whether that designation was relevant or not. How will the regulator know what it should look at? Does the hospital trust go to the regulator and say, 'Hello regulator, here is a list of all the private service providers who are supplying our OES—and by the way, this list is going to change every single day,'?

I visited the Maypole special school in my constituency. It has 20 members of staff and 18 pupils. It books the transport, and the transport is paid for by the local education authority in which the pupil lives. It is clearly critical that children get to the school—just as it would be for a hospital.

I really struggle to see how an OES that is providing a service to another OES could effectively argue that it is not within the full scope of these regulations. A lot of providers are going to think, 'Why should we provide to an OES when we might be at risk of being designated as a national critical supplier?' This will have a chilling effect on organisations supplying to OESs.

Responded to points raised about operational technology and proportionality. Confirmed that vendors and providers of operational technologies will be covered by the provision of the five-step test for critical supplier designation. Highlighted that the Bill takes a nuanced position on proportionality, ensuring clarity on the number of suppliers affected and their ultimate impact.

Asked about schools being within the scope of the Bill and questioned the Minister's characterisation of the Bill’s provisions as not knowing how many critical suppliers there are or the cost implications. Emphasised that patient data and children’s data are precious, raising concern over why schools are not covered.

Agreed with the necessity of introducing measures to protect critical infrastructure, even if the exact number of critical suppliers is unknown. Supported the introduction of regulations as soon as possible.

Raised concerns about legal disputes that may arise after implementation and questioned the Minister’s dismissive comments, highlighting the importance of specific concerns for future legal arguments.

Proposes amendments to clause 15 to ensure that incidents involving autonomous or adaptive systems based on machine learning are reported. Argues that this is necessary due to the increasing use of AI in cyber-attacks and the need for data on such risks.

Acknowledges concerns about emerging AI risks but argues against specifying risk factors in the Bill. Suggests that technology is agnostic to specific risks and mentions ongoing work by the Government on mitigating such risks through the AI Security Institute.