Cyber Security and Resilience (Network and Information Systems) Bill
Public Bill Committee, 3 February 2026.
Andrew Murrison (Conservative, South West Wiltshire)
Good morning, everyone. We are now sitting in public and the proceedings are being broadcast. I remind Members, please, to switch electronic devices to silent, and that tea and coffee are not allowed during sittings. Today, we will first consider the programme motion on the amendment paper. We will then consider a motion to enable the reporting of written evidence for publication and a motion to allow us to deliberate in private about our questions before the oral evidence sessions. In view of the time available, I hope we can take those matters formally without debate. I call the Minister to move the programme motion standing in his name, which was discussed yesterday by the Programming Sub-Committee for the Bill.
Andrew Murrison (Conservative, South West Wiltshire)
Copies of written evidence received by the Committee will be made available in the Committee Room.
Examination of Witnesses
Andrew Murrison (Conservative, South West Wiltshire)
We are now sitting in public again. We have heard declarations of interest. If there are any other others, please say. We will now hear oral evidence from Jen Ellis, associate fellow for cyber and tech at the Royal United Services Institute, who is joining us online, and David Cook, who is a partner at DLA Piper. Thank you for coming.
Before calling the first Member to ask a question, I remind Members that questions should be limited to matters within the scope of the Bill. We must stick to the timings in the programme order that the Committee has agreed to. For this session, we have until 10 am. I call the shadow Minister.
Ben Spencer (Conservative, Runnymede and Weybridge)
Thank you, Jen and David, for coming to give evidence to us morning. Two questions. First, one to you, Jen. Lots of UK corporations have been the subject of recent major cyber-attacks, such as Jaguar Land Rover and M&S. Under the Bill as drafted, these remain outside the scope of the regulation. In your view, what is the best way to mitigate the risk to the economy, jobs and supply chains of further cyber-attacks of that scale to these important out-of-scope businesses? Secondly, and linked to that: Mr Cook, what lessons have you learnt from assisting clients with the implementation of NIS2—the second network and information systems directive—on the need for certainty in legislation? What do you think will be the most challenging areas of business to implement this BillQ ?
Christopher Vince (Labour/Co-operative, Harlow)
I feel that I should declare an interest as the MP for Harlow, which has a large data centre within itQ . My question is about international alignment. Is this legislation in keeping with developments that you are seeing globally?
Bradley Thomas (Conservative, Bromsgrove)
Picking up on what Jen mentioned about FTSE and publicly traded companies being within scope, is there a view on ensuring Q g that privately owned companies of a particular scale are within scope, and if so, how will you determine that? Might it be based on things such as turnover or number of employees, or would it be some other identifiable characteristic?
Tim Roca (Labour, Macclesfield)
This question is mainly for Jen. Your colleague Jamie MacColl has made a series of forthright comments about the Bill and compared it to NIS2. How does the Bill compare to legislation worldwideQ ?
Kanishka Narayan (Labour, Vale of Glamorgan)
Q Thank you very much to both of you for your insights today. The question on my mind is related, in part, to the point that Jen raised. There are a range of levers at the Government’s disposal in thinking about and acting on cyber-security. I am interested in your thoughts on which parts of the economy ought to be in the scope of regulation and legislative measures, and where effective measures that sit outside of regulation and legislation—guidance being one from a range of non-regulatory measures—would be better suited.
Emily Darlington (Labour, Milton Keynes Central)
I want to go back to basics and get a bit of insight from you. What cyber risks are businesses currently facing, and how do you feel the Bill addresses those risks?Q
Freddie Van Mierlo (Liberal Democrat, Henley and Thame)
I want to take a step back and ask a broader question about why this legislation is necessary. I think we agree that it is, but why are companies not already adhering to very high cyber-security standards? Surely it is in their commercial interests to do so; last year we saw the massive impact on JLR, M&S and the Co-op of failing to do so. Why might the state need to mandate companies to be cyber-secure and make them cyber-secure?Q
Alison Griffiths (Conservative, Bognor Regis and Littlehampton)
You have both mentioned the risk involved in supply chains. Do you think that, outside regulated industries, the Bill goes far enough to secure supply chains? If not, what would your recommendations be?Q
Andrew Murrison (Conservative, South West Wiltshire)
Thank you. I am going to bring Allison Gardner in, because she has been waiting. You have two minutes, Allison.
Allison Gardner (Labour, Stoke-on-Trent South)
I have a quick question. You mentioned vulnerabilities earlier, and you mentioned, Jen, the complexities of implementing cyber-security plans. As well as technological factors, human factors, not the least of which is the lack of skills, play a key role in cyber-resilience. How would or could the Bill address the human element in cyber-security?Q
Andrew Murrison (Conservative, South West Wiltshire)
Order. Thank you very much, but I have to cut you off there.
Andrew Murrison (Conservative, South West Wiltshire)
No, you have been brilliant.
That brings us to the end of the time allotted for the Committee to ask questions. On behalf of the Committee, may I thank you both for sparing time from your busy schedules to give evidence this morning?
Andrew Murrison (Conservative, South West Wiltshire)
Good morning, everyone, and welcome. We will now hear oral evidence from Jill Broom, head of cyber-resilience at techUK, from Stuart McKean, chairman of Nine23, and from Dr Sanjana Mehta, senior director for advocacy at ISC2. We must stick to the timings in the programme motion that the Committee has agreed for this session; we have until 10.40 am. Will the witnesses please briefly introduce themselves for the record?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you for giving evidence this morning. The Bill would not have prevented recent attacks on high-profile parts of UK industry such as Co-op, Marks and Sparks, and Jaguar Land Rover. What more do you think can be done to mitigate the risk to jobs, supply chains and the UK economy from further large-scale cyber-attacks against out-of-scope companies?
My second question is a bit more technical. Do you consider that the definition in the Bill of a managed service provider is sufficiently clear and certain for businesses to understand whether they are in scope or out of scope of the Bill?
Andrew Murrison (Conservative, South West Wiltshire)
The witnesses need not feel obliged to answer every question; if colleagues could direct their questions to individual witnesses, we will get through quicker.
Kanishka Narayan (Labour, Vale of Glamorgan)
Q Thank you all very much for making time. I have an implementation-focused question, perhaps directed at Stuart, but open to all. In practice, it would be helpful to understand how frequent is the case that a single company might provide multiple of the possible services in scope: MSP services, cloud hosting, data centre support and cyber-security services. What ability might we have to identify parts of an organisation that are in scope for particular bits and those that are not?
Allison Gardner (Labour, Stoke-on-Trent South)
Q It is interesting that you mentioned the complexity and skilled teams. Sanjana, you talked about the need for more skill and responsibility, and how distributed responsibility across supply chains is a big deal. That comes down to a duty of care on people who are procuring these things. The annual cyber security breaches survey found that board-level responsibility for cyber has declined in recent years. What explains that, and how could it be improved? As a quick supplementary question, do you think there should be a statutory duty for companies to have a board member responsible for cyber risk? Jill, I will go to you first.
Allison Gardner (Labour, Stoke-on-Trent South)
Q But do you think there should be a statutory duty to have a board member responsible?
Bradley Thomas (Conservative, Bromsgrove)
Q Two questions: first, for a bit of context, could the witnesses give us an idea of the objectives of cyber-attacks? Are we seeing objectives based around disruption or around extortion, either monetary or for intellectual property? Perhaps we could have a perspective on whether that differs depending on the origin of the organisation conducting the cyber-attack. Secondly, around the reporting model, is there a view on whether the model proposed in the Bill is beneficial, and whether it risks a fragmented approach, particularly if companies operate in a sector that is regulated under the jurisdiction of two regulators? Do you think that a more universal, singular reporting model would be beneficial in ensuring as strong a response as possible?
Freddie Van Mierlo (Liberal Democrat, Henley and Thame)
Q I have two questions: one to Jill and one to Dr Mehta. First, what is your view, Jill, on the relative strength of this legislation, compared to what is coming forward in the EU? Do you think that the fact that we are not following the EU will make it harder for your members to interact and trade with individuals and companies in Europe?
Secondly, Dr Mehta, you spoke earlier about what is not in scope in this legislation. I am particularly interested in the fact that local government is not included in it, because it has a critical role in electoral services and in local and national democracy. What do you think are the threats from leaving local government out of scope?
Lincoln Jopp (Conservative, Spelthorne)
On the question of closer alignment, can you give us a sense from the international picture of whether certain regulatory regimes raise the barrier to terrorists or criminals so high that they are left alone? Is that a national thing or a company-based thing? Where are the flow lines of attack and threat? Is it on a national or a corporate basisQ ?
Alison Griffiths (Conservative, Bognor Regis and Littlehampton)
I am so sorry. Could you possibly speak into the microphone? I cannot hear you.
Lincoln Jopp (Conservative, Spelthorne)
Q I appreciate that. My question was about where that leads them to attack, on the basis that they will take the route of least resistance. Where is that? Is that an international thing, a national thing or a corporate thing?
Lincoln Jopp (Conservative, Spelthorne)
Do either of the other witnesses have anything to say on that?
Andrew Cooper (Labour, Mid Cheshire)
I have a question for Jill Broom. You were talking about the incident reporting requirements. Do you think the legislation strikes the right balance to encourage organisations to Q come forward when they have been attacked, so that the sector can learn from that and vulnerabilities can be patched out in other areas, or is it so stringent that organisations will be concerned about facing penalties if they are fully transparent?
Andrew Cooper (Labour, Mid Cheshire)
Q Stuart, you were nodding, which suggests you have something to contribute.
Sarah Russell (Labour, Congleton)
Obviously no one wants to put crippling costs on to businesses, but cyber-security costs money—there is no way of avoiding that. We only have to look at the JLR attack to see the scale of the impact on our economy when it does not work, and we are looking at only critical national infrastructure here. Have you had any information from business about whether and to what extent this will promote increased spending on cyber-securityQ ?
Alison Griffiths (Conservative, Bognor Regis and Littlehampton)
Q Returning to the supply chain risks, I want to ask you about the difference between OT—operational technology—and IT, and whether there is sufficient detail in the Bill to protect that. If you have intelligent electronic devices from single suppliers across multiple sectors, are we confident that there is sufficient detail about what the regulatory role is in saying that suppliers should be within scope? Is more detail needed in the Bill?
Alison Griffiths (Conservative, Bognor Regis and Littlehampton)
Q Do you think that there should be more or not?
Alison Griffiths (Conservative, Bognor Regis and Littlehampton)
Does anyone have anything else?
Andrew Murrison (Conservative, South West Wiltshire)
Feel free to write in, secondary to this session, if you feel that you want to expand on any answers.
Dave Robertson (Labour, Lichfield)
I have a bit of a blended question. Earlier, Stuart, you said that some of the wording in the Bill says that only 11% of managed service providers are likely to be covered by the legislation, but in previous answers we have heard about skills shortages and where we will need to build those skills. Although I think we all want as many organisations covered as possible, where is the line? Do we currently have enough professionals working in this space to be able to deliver this level of compliance across 11% of MSPs? Given the number of people available for this very specialised work, is the 11% figure in the right ballpark, or do we need to make that wider or thinner to ensure compliance?Q
It is very easy to write a piece of legislation, but if we do not have the professionals needed to deliver the level of compliance at the thresholds we are setting in this place, that raises other potential issues. Do you have a view about whether the 11% you mentioned is in the right ballpark for the number of professionals we have, or whether it needs to move either way?
Andrew Cooper (Labour, Mid Cheshire)
Q Stuart, as an MSP, you will be familiar with the fact that the large cloud service providers tend to allow you to live failover to different regions. By default you might be hosting in the UK region, but, depending on an outage, you might live failover to the European Union or to the US, depending on the cloud service provider you are using and how it is set up. How does the legislation deal with that and allow you as an MSP to be compliant with it?
Bradley Thomas (Conservative, Bromsgrove)
Q Do the witnesses have a view on the benchmarks that, at the moment, do not appear to sit behind the scale of incidents that must be reported? Do you have a view on the absence of any benchmarks and the impact that they may have on smaller firms, or on the risk of over-reporting?
Bradley Thomas (Conservative, Bromsgrove)
Q How might we glean some clarity on that?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q The issues about complexity and how loosely the Bill is drafted have come up quite a few times, and you have given good evidence regarding your concerns. What cost to business do you anticipate if the Bill stays so loose, with so much left to secondary legislation?
Andrew Murrison (Conservative, South West Wiltshire)
I am looking around the table, and it seems to me that everybody is satisfied. Thank you very much indeed, Sanjana, Jill and Stuart, for giving your time so freely this morning—I know you are very busy people.
Andrew Murrison (Conservative, South West Wiltshire)
Q We will now hear oral evidence from Matt Houlihan, vice-president for government affairs in Europe for Cisco UK and Ireland, Ben Lyons, senior director of policy and public affairs for Darktrace, Chris Anley, chief scientist for NCC Group, and Dr Ian Levy, vice-president of security at Amazon. We must stick to the timings in the programme order; for this session we have until 11.25 am. Could the witnesses please introduce themselves briefly for the record, starting with Dr Levy?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you for coming to speak to us this morning. I have a different question for each of you, so I will rattle them off and ask you to go through them.
Starting with Ben from Darktrace, how are developing and emerging technologies such as AI and post-quantum crypto changing the nature of cyber-security threats? Do you think the Bill responds adequately to that changing threat landscape?
Moving on to Matt from Cisco, what further guidance and consultation from the Government and the Information Commissioner is needed for MSPs to comply effectively with their obligations under the Bill?
Chris from NCC Group, the National Audit Office report last year highlighted lots of serious deficiencies in Government cyber-resilience. Do you think the cyber action plan goes far enough? How can Government Departments be overseen and held to account in a way that will deliver meaningful improvements in cyber-resilience?
Finally, Ian from Amazon, a core feature of your business model is extensive exposure to supply chain partners. Do you think that the designation of critical suppliers by regulators under the Bill is the correct approach? What further consultation is needed to make sure that that is proportionate, prioritises the most critical suppliers and, crucially, gives a degree of certainty, whether legal or financial?
Andrew Murrison (Conservative, South West Wiltshire)
I should say to the witnesses: do not feel obliged to answer each question if you do not feel that you have anything material to add.
Kanishka Narayan (Labour, Vale of Glamorgan)
Q One of the themes already emerging in the conversation and in the wider public debate is that, on one line of thought, the right framework is that the law should focus on outcomes, principles and responsibilities, and then delegate specificity to both agile definition over time and specific expertise in sectors. An alternative view says that in looseness there is uncertainty, and we in Parliament should prescribe activity and impact thresholds and what companies should be doing. I am interested in areas across the board where you think prescription is a helpful way to go, as well as in your general experience of the core way and framework through which we have regulated a number of these activities, which is to rely on the agility and expertise in particular sectors, rather than the prescription of activity in primary legislation.
Andrew Murrison (Conservative, South West Wiltshire)
Four colleagues wish to ask questions, and they have only 20 minutes in which to ask them, so I appeal for brevity, both in the questions and, if you do not mind, in the answers.
Bradley Thomas (Conservative, Bromsgrove)
Q I have two questions. First, on the topic of cross-border control, how do you think we can get definition around the resilience obligations and how they apply to foreign-hosted systems, particularly given that your networks will be quite widespread? My second question is more broad. Given that you are all responsible for operating networks that are strategically important, and that you are also commercial companies, how do you think we strike the right balance between growth in AI, proportionate regulation and not stifling commercial innovation?
Andrew Murrison (Conservative, South West Wiltshire)
Please, Gentlemen, do not feel obliged to answer each question.
Allison Gardner (Labour, Stoke-on-Trent South)
Q I have so many questions, some of which have been touched on; I will limit myself. I was interested in the CyberUp campaign that you mentioned. What other measures, both legislative and non-legislative, could the UK Government take to enhance the cyber-resilience of the UK’s critical national infrastructure? In terms of resilience, is there any requirement to look a bit more deeply at failsafes and non-technical failsafes that we might need, because we are always going to get that?
My second question is for Ben. In combining AI and cyber, you are combining technologies that come with their own unique risks with cyber-security. I am interested in how you mitigate against that. I am intrigued because, when you talk about AI, I assume you are not talking about straightforward machine learning.
Allison Gardner (Labour, Stoke-on-Trent South)
Q Ben, are you combining two risks?
Christopher Vince (Labour/Co-operative, Harlow)
Q Thank you for coming along. Chris has touched on this already, but the Government’s impact assessment of the Bill said that the UK was falling behind its international partners. You all have experience of working globally. Could you comment on that and whether you agree with it?
Emily Darlington (Labour, Milton Keynes Central)
Q A huge thank you to the panel. Many of my colleagues have already asked the question, so I appreciate you talking about the futureproofing in quantum, the international regulatory environment and the use of standards alongside regulation to drive up quality. You all have a huge amount of UK clients, and I want to ask you about how good cyber culture gets embedded, and what the role of the Bill is within that. To pick up on Ben’s point around the security by design within his own firm, do you think that is well understood among your colleagues in the UK? How do we get the balance right between what is in the regulation and what should be done through a standards model, working with the British Standards Institution and others?
Andrew Murrison (Conservative, South West Wiltshire)
Very briefly—yes.
Alison Griffiths (Conservative, Bognor Regis and Littlehampton)
Q I have two specific questions. The first is about OT versus IT. Do you think that OT and its supply chains are sufficiently covered in the Bill? Secondly, given that you are all from commercial organisations, from your direct client experience, what is going to be the thing that moves the dial on board governance, specifically in relation to cyber?
Andrew Murrison (Conservative, South West Wiltshire)
I call Freddie van Mierlo for the last question.
Freddie Van Mierlo (Liberal Democrat, Henley and Thame)
Q I want to ask about some of the points made by Matt and Ian about the complexity of the businesses that you are part of. Ultimately, who is responsible for understanding that? In this House and in Parliament, we are responsible for looking at UK security, and we can only have control over that. Do you think it is the responsibility of Government and Parliament to look at and understand how complex your businesses are, or is it the responsibility of those businesses to comply with the legislation of the countries that they want to operate in?
Andrew Murrison (Conservative, South West Wiltshire)
Thank you very much indeed, gentlemen.
Emma Lewell (Labour, South Shields)
Good afternoon. We will now hear oral evidence from Ian Hulme, the interim executive director of regulatory supervision and director of regulatory assurance for the Information Commissioner’s Office; Natalie Black, group director for infrastructure and connectivity for Ofcom; and Stuart Okin, director of cyber regulation and artificial intelligence for Ofgem. We need to stick to the timings in our programme order, so we have until 2.40 pm for this session. Could the witnesses please introduce themselves briefly before we hand over for questions?
Ben Spencer (Conservative, Runnymede and Weybridge)
Thank you for giving your time this afternoon. I have a couple of questions, which I will deal with in one go. The first is for Natalie. Ofcom’s role in cyber-security regulations will be expanded significantly under the Bill. What preparation has Ofcom undertaken to ensure it has sufficient capacity for effective oversight and, where necessary, enforcement in relation to its new regulatory obligations?Q38
My second question is jointly for Ian and Stuart, from the ICO and Ofgem. Some industry stakeholders have expressed concern about low levels of incident reporting and enforcement under the NIS1—network and information systems—regs. How will your respective approaches to regulation change as a result of this Bill, to ensure that it is implemented and that cyber-resilience is improved across the sectors you are responsible for regulating?
Christopher Vince (Labour/Co-operative, Harlow)
I declare an interest. My father-in-law is Professor Robin Bloomfield, a professor of software and system dependability at City St George’s, University of London, and I have a large data centre in my constituency. My question is probably shorter than that. Why is it important to give regulators flexibility to implement guidance for the sectors they coverQ ?
Allison Gardner (Labour, Stoke-on-Trent South)
I should point out that I once worked for the NHS AI and Digital Regulations Service and have also worked for a number of different regulators, including the ICO, so I have experience of the joys and frustrations of cross-regulatory working. We have heard evidence of the challenges experienced by businesses when they have to go to different regulators—I think it is as many as 14—and deal with the conflicting guidance they are often given and the skillset within each regulator. There were calls for one portal for incident reporting.Q
The ICO is a horizontal regulator working across all sectors. In your experience, would a single cyber regulator be a good idea? What would be the benefits and the challenges? I will allow Ofcom and Ofgem to jump in and defend themselves.
Bradley Thomas (Conservative, Bromsgrove)
What additional resources will you need in order to implement and enforce the requirements of the Bill?Q
Bradley Thomas (Conservative, Bromsgrove)
Q Are you able to quantify that in any way?
Tim Roca (Labour, Macclesfield)
I was reading the ICO’s response in December, as this legislation was proceeding, and it talks a little about having clarity around secondary legislation, the Secretary of State’s powers and the definition of “significant impact”. What are your concerns about the secondary legislation, or what you would like to make sure is right in it?Q
Tim Roca (Labour, Macclesfield)
Q Is there anything that you would have preferred to see in the primary legislation, or do you think secondary legislation affords industry and Government flexibility?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Natalie, I am going single out Ofcom, which has a lot on its plate at the moment, particularly when it comes to the implementation of the Online Safety Act 2023 and all its other duties. Are you set up to administer your duties under the Bill? Are your resources siloed, given Ofcom’s competing considerations, particularly over the next few years?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q That sounds slightly like an argument for having a single regulator, as opposed to multiple sector regulators. I apologise if I am putting words into your mouth.
Ben Spencer (Conservative, Runnymede and Weybridge)
Q From all three of your perspectives, are you quite clear about where your individual institutional responsibilities lie? Is there clear water between the organisations? When Ian Levy from Amazon gave evidence this morning, I was struck when he said that Amazon is regulated in the cyber-security space by four regulators. Is the separation of duties and responsibilities clear? Is there a risk that the Secretary of State’s ability to designate critical security risks will muddy the water a bit?
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
I would like to continue the line of questioning on the importance of having a single regulator. Other countries, such as the Netherlands, have recently merged their cyber-security organisations. The Bill introduces expanded but sector-specific reporting requirements, to apply to regulators across different sectors. Do you believe that this fragmented reporting landscape risks preventing Government and regulators from forming a coherent a cross-sector picture of emerging threats—particularly when foreign actors may be probing multiple systems simultaneously? If so, what measures could be taken to mitigate that risk?Q
It strikes me that, if one of the things that this legislation is to guard against is pre-positioning, and there are 14 parallel reporting systems in place, it could be the case that those pre-positioning attacks are not picked up as co-ordinated attacks from another nation state or organisation, because they are not pulled together in time.
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q Do you know how you would do that information sharing at the moment?
Emily Darlington (Labour, Milton Keynes Central)
I have a question for Ian Hulme. In your role at the ICO, you are clearly looking atQ data security. Data is obviously one of the main goals of cyber-attacks. Data issues cut across every sector, and you are looking at a really broad sector of data, from individual identifiers to names, addresses, bank accounts or whatever it might be. This could happen in any sector. How does the Bill give you additional powers to take action, particularly on those co-ordinated through AI or foreign actors, and do you think it is sufficient for what you feel we will be facing in the next five years?
Lincoln Jopp (Conservative, Spelthorne)
One of my favourite aphorisms is, “Institutions get the behaviours they reward.” We had a cry from Amazon Web Services this morning about how, when a regulator deals with a company in the event of a cyber-security attack, please remember you are dealing with a victim.Q
I have dealt with the ICO before. Maybe it was the company that I worked in and led, but there was a culture there that, if you had a data breach, you told the ICO. There was no question about it. How are you going to develop your reactions and the behaviours you reward in order to encourage a set of behaviours and cultures of openness within the corporate sector, bearing in mind that, as was said this morning, by opening that door, companies could be opening themselves up to a hefty fine?
Emma Lewell (Labour, South Shields)
We have only five minutes left for this session, so if we can have concise questions and answers we might get everyone in.
Sarah Russell (Labour, Congleton)
One of the things talked about this morning was that the risk in these relationships and sectors will simply be managed down the supply chain until it is essentially contracted out of existence, because the smallest organisations that end up holding the risk will be incapable of effectively managing it. Should they fail, because they have not failed the risk and their liabilities become so big, they will just collapse. It will not be possible for you guys to manage the entirety of the supply chain down, so how do you see your enforcement capabilities and the adequacy or otherwise of the legislation in that contextQ ?
Emma Lewell (Labour, South Shields)
I call Freddie van Mierlo. You have one minute.
Freddie Van Mierlo (Liberal Democrat, Henley and Thame)
I shall be brief. One of the things we heard this morning is that, by its very nature, companies who require and also supply these kinds of digital services are not geographically bound. They are cross-border. How do you, as regulators in the UK, manage and understand the need to regulate companies that operate cross-borderQ ?
Emma Lewell (Labour, South Shields)
That brings us the end of the allotted time for the Committee to ask questions. On behalf of the Committee, I thank our witnesses for their evidence.
Examination of Witness
Emma Lewell (Labour, South Shields)
We will now hear oral evidence from Chung Ching Kwong, senior analyst for the Inter-Parliamentary Alliance on China. We have until 3 pm for this session.
Christopher Vince (Labour/Co-operative, Harlow)
Q Thank you for coming to give evidence. What methods are hostile state actors using to infiltrate UK essential services, and what can we do to prevent that?
Christopher Vince (Labour/Co-operative, Harlow)
Q I was thinking specifically about data. There is a back and forth about digital IDs, for example, but the reality is that a lot of people’s data already exists on the internet. Is it your view that it is not necessarily about the short-term financial gain that the data can provide, but a long-term process of gathering information?
Christopher Vince (Labour/Co-operative, Harlow)
That was a far better answer than my question. Thank you.
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you for coming to give evidence this afternoon. I have two questions. First, what more could the Government be doing to make regulated sectors aware of the risks you have just laid out and what they can do to address them?
Secondly, it has been reported recently that communications of senior Government aides were hacked by Chinese state affiliates between 2021 and 2024. In view of that threat to telecoms networks, what are the potential cyber-risks to communications infrastructure that you see arising from the intended location of China’s super-embassy in the City of London?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q It was about China’s super-embassy in London. What cyber-security risks do you think that poses, given your experience and background?
Dave Robertson (Labour, Lichfield)
Thank you for coming in to talk to us this afternoon. The Bill includes Q a couple of backstop powers for the Government to compel information and things like that. Are those powers sufficient to guarantee national security?
Bradley Thomas (Conservative, Bromsgrove)
Q For the avoidance of doubt, I will put on the record that I am a member of the IPAC caucus in this Parliament. Thank you for coming in to see us. You have spoken about the threats from hostile and adversarial states. Given the scope of what we are talking about, can you give us any insight on what comparable western nations are doing to protect themselves?
Tim Roca (Labour, Macclesfield)
Q I, too, put on the record that I am a member of the IPAC caucus in this Parliament.
Thank you for speaking to us today. May I turn the conversation a little on its head? We have been talking about national security and the threat from China and others. You were an activist in Hong Kong and made a great deal of effort to fight the Chinese Communist party’s invasion of privacy—privacy violations using the national security law—and other things. Do you see any risk in this legislation as regards civil liberties and privacy? We have had a bit of discussion about how much will go into secondary legislation and how broad the Secretary of State’s powers might be.
Tim Roca (Labour, Macclesfield)
Q From the other perspective—I am thinking about a UK Government in the future overreaching—do you think there is any risk from this legislation?
Emily Darlington (Labour, Milton Keynes Central)
Q I want to move from software to hardware that is particularly vulnerable to potential cyber-attack, particularly from the integration of Chinese tech into SIPs, possibly making them vulnerable to cyber-attack by someone who knows the code into those bits of hardware. Should we be doing more to protect against that vulnerability? Should that be covered by the Bill?
Emma Lewell (Labour, South Shields)
That brings us nicely to the end of the time allotted for the Committee to ask questions. On behalf of the Committee, I thank our witness for her evidence.
Emma Lewell (Labour, South Shields)
We will now hear evidence from Professor John Child, professor of criminal law at the University of Birmingham and co-founding director of the Criminal Law Reform Now Network. For this session, we have until 3.20 pm.
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you for coming to give evidence this afternoon. I have a couple of questions. First, how can industry and cyber-security researchers collaborate more effectively to increase cyber-resilience in the network and information systems of regulated sectors? Secondly, and building on that, are there any model schemes or arrangements for reporting risks to affected companies that could incentivise legitimate research activities?
Sarah Russell (Labour, Congleton)
Q Professor Child, I note that you are very supportive of legal reform in quite a number of areas. With emphasis on the Computer Misuse Act, surely the reality is that the Crown Prosecution Service will never conclude that it is in the best interests of the country to prosecute any of the behaviours that people are concerned about, which we recognise as positive and helpful. Is there a need for legal reform?
Allison Gardner (Labour, Stoke-on-Trent South)
Q I have a couple of unconnected questions. We have asked a couple of times whether senior board members should have legal, statutory responsibility for cyber. The pros are that it is not seen as a priority, and culture change has to be top-down. However, there are issues with smaller companies bearing a responsibility that is diffused along the supply chain. Also, boards that tend to have a focus on providing returns for shareholders may not be investing in this complex arena. I am interested in your thoughts on whether the Bill does enough to make senior executives responsible for their organisations’ cyber-security.
Allison Gardner (Labour, Stoke-on-Trent South)
Q Thank you—that was quite detailed. I have a very quick question: what measures would you want the Government to take to enhance the cyber-resilience of the UK’s critical national infrastructure? I am interested in your thoughts on requirements for failsafes and risk management, and indeed on the non-technical resilience measures that would be needed in case of complete failure.
Allison Gardner (Labour, Stoke-on-Trent South)
I think you are touching on the old problem of where liability lies when you have this long supply chain of diffused responsibility, but thank you.
Dave Robertson (Labour, Lichfield)
Q Thank you, Professor, for coming along. You said that when the Computer Misuse Act was written in 1990, not many people were doing cyber-security work. You attested that the criminalisation element was negative for a number of reasons. Obviously, since then, a private sector has grown up in this area. I am struggling to marry those two pieces of information together. Can you give us an impression of other jurisdictions and of international comparators where things may be different, and whether they have been able to get ahead of us in building a more thriving sector? Are we particularly lagging behind in the OECD? Are other countries ahead of us because they do not have the measures we do?
Dave Robertson (Labour, Lichfield)
Q That is a really helpful international comparator on where others are with the criminal law. Is there any correlation between that and the ability of people within those jurisdictions to act and work in this space? In the UK, we have seen a significant increase in the number of people working in this area since 1990. That is the real thing for me: whether we can prove that, internationally, there is a significant difference between jurisdictions that are minimalist or maximalist. If one of them is encouraging more people to work in this area, and therefore has a wider pool of talent, are they able to protect critical infrastructure better? Does that correlation exist?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q What are the arguments against amending the CMA, and how would you deal with them?
Emma Lewell (Labour, South Shields)
That brings us to the end of the time allotted to ask questions. On behalf of the Committee, I thank our witness for his evidence. We move on to our next panel.
Examination of witness
Emma Lewell (Labour, South Shields)
We will now hear oral evidence from Detective Chief Superintendent Andrew Gould, programme lead for the National Police Chiefs’ Council cyber-crime programme. For this session, we have until 3.40 pm. I call Dr Ben Spencer.
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you very much for coming in to give us evidence this afternoon, and thank you for your service. I have two questions. Who are the main threat actors in cyber-attacks on UK networks and information systems—what do they break down into, in terms of state actors, affiliates and criminal gangs?
Secondly, on ransomware attacks, you will know that the Government review states that ransomware is
“the greatest of all serious and organised cybercrime threats”.
In your view, what is the scale of that threat and what sectors and businesses are the primary targets?
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q Thank you for joining us. You mentioned frauds. It is a fact that criminals across the world are targeting British citizens every day. In Dyfed-Powys, over £500,000 was lost to online fraud in 2023-24, and elderly victims are losing £7,900 a day to fraud. Clearly, these attacks are coming from all over the world. Interpol recently arrested over 800 members of a global criminal network based in Nigeria. From your perspective, how effectively are UK police forces currently able to work with international partners to investigate and prosecute overseas criminals? What additional support from the Government would most improve your ability to mitigate online fraud from overseas?
Kanishka Narayan (Labour, Vale of Glamorgan)
Q One of the things that we have heard over the course of the day is that the Bill is just one of a range of different ways in which public authorities engage with companies on cyber-security and resilience. I am interested in hearing about the impact the Police CyberAlarm programme has had on the cyber-security and resilience of organisations. What would you like to see going forward?
Bradley Thomas (Conservative, Bromsgrove)
Q With regard to ransom payments and extortion attempts, what do you typically see? Is it for monetary gain or intellectual property data—what is the split?
Christopher Vince (Labour/Co-operative, Harlow)
Q Part of my concern is the pace of change in the technology that hackers are using, and I am sure that is a concern for you as well. One of the conversations about the Bill is about how flexible or inflexible it should be. What is your view on the changing pace of the threat we face from criminality when it comes to cyber-attacks, and on how the Bill can best be framed to deal with that ever-changing challenge and threat?
Emma Lewell (Labour, South Shields)
Order. That brings us to the end of the time allotted for the Committee to ask questions. I thank the witness for his evidence.
Examination of Witness
Emma Lewell (Labour, South Shields)
We will now hear oral evidence from Richard Starnes, chair of the information security panel for the Worshipful Company of Information Technologists. We have until 4 pm for this session.
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you, Richard, for giving evidence this afternoon. I have a couple of questions. First, in your view, was the regulatory enforcement regime under NIS1 effective, and does the Bill, as drafted, tackle those challenges? Secondly, could you explain how information sharing and analysis centres improve cyber-resilience in the sectors in which they currently operate?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Do you think that would be helpful in this context?
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q Thank you for joining us. Reporting of several recent cyber-attacks has one thing in common: there were often insufficient security measures in place. British Airways in 2018 is just one example. Reportedly, the average tenure of a chief information security officer is 18 months. From your perspective, what do CISOs need from the Bill to help strengthen their hand when they are saying to a board, “This is what I need to do to keep our organisation secure”?
Allison Gardner (Labour, Stoke-on-Trent South)
Q You have answered the question I was about to ask. I may ask an addendum to that, but first I want to clarify something. If you put liability on an individual board member, that is going to cause problems. Do you think that there should be a statutory responsibility for the company to have a board member responsible for cyber-risk, and that the responsibility and accountability should sit at company level?
Allison Gardner (Labour, Stoke-on-Trent South)
Q You mentioned stringent application of the regulatory regime. Could you explain the reasons for the lack of enforcement under the current NIS guidelines? Do you feel that the regulatory regime should be streamlined?
Allison Gardner (Labour, Stoke-on-Trent South)
I know, sorry. I collapsed it down from quite a few.
Allison Gardner (Labour, Stoke-on-Trent South)
Q I am just thinking that if you are putting liability on someone, you need to make sure that they can apply the regulation in a simple and effective manner and ensure that it is enforced, so they do not carry the full burden of liability.
Emily Darlington (Labour, Milton Keynes Central)
Q I note your interest in how the Bill will affect smaller businesses. There is not much detail in the Bill, but how do you think the code of practice could create an environment that lifts everyone’s security up without prescribing too great a burden?
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q We have heard concerns about definitions, particularly regarding incident reporting. What are your observations on the Bill as it stands, and those definitions?
Emma Lewell (Labour, South Shields)
If there are no further questions, I thank our witness for his evidence. I will suspend the Committee for a few minutes because our next witnesses, who will give evidence online, are not ready yet.
Examination of Witnesses
Emma Lewell (Labour, South Shields)
We will now hear oral evidence from Brian Miller, head of IT security and compliance, and Stewart Whyte, data protection officer, both from NHS Greater Glasgow and Clyde and joining us online. For this session we have until 4.20 pm. Will the witnesses please introduce themselves for the record?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you for giving evidence to us. I want your help to get my head around what could fall under the Bill’s discretionary power on the designation of critical supply chain entities. Synnovis is used as the exemplar of why such a power is needed. From your perspective in the NHS, what do you think would come into scope? For example, would patient transport or taxis come under scope as critical for the delivery of your services? Would a hospital cleaner come under the scope of a critical supplier if the service was outsourced to a private sector organisation? Would food provision in your hospital come under scope? Would the provision of materials, medicines or medical devices provided by private companies come under scope? Would the provision of IT services—physical computers, not cloud services—come under scope? Would locum agencies come under scope? In fact, would any private provider not come under the scope as critical for the provision of services linked to your organisation’s IT system?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Presumably, all suppliers are in some way linked to your IT systems to some degree. I know the NHS sometimes uses faxes still, but we do not live in a world where things are done by paper and pen—it is all integrated into IT systems.
Christopher Vince (Labour/Co-operative, Harlow)
Q Thank you for joining us remotely from Scotland. I have a question for Stewart about data protection. In my Harlow constituency we have just got a new electronic patient registration scheme; what risks do you see in the increased use of technology like that in the NHS? Does the Bill help to address some of the risks?
Allison Gardner (Labour, Stoke-on-Trent South)
Q I am interested in who you report to should you identify a cyber-incident. I am talking about not just data breaches but wider ones that can affect operational systems. Which regulators do you deal with? If it is multiple regulators, do you feel there is a case for having one distinct regulator to cover cyber-resilience and manage that quite difficult landscape?
Lincoln Jopp (Conservative, Spelthorne)
Q To come back to Dr Spencer’s original question about the scope of the legislation, the current situation, as I understand it, is that there is a carve-out for small and medium-sized enterprises because we do not want to put too much regulatory burden on them, but, under the new proposed legislation, operators of essential services that are SMEs will be designated by their regulator. That brings us back to the question of which regulator that would be. Do you currently use that designation for operators of essential services, or would you have to do a piece of work, presumably looking at a number of different regulators’ points of view, to designate the operators of essential services?
Lincoln Jopp (Conservative, Spelthorne)
Q I want to make sure I have understood exactly. Is the regulator going to tell you who your operators of essential services are, or are you going to tell the regulator?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Your evidence is really helpful. To help with my understanding, if you look across all the suppliers in your service, are there any that you would not consider to be critical, such that if you clicked your fingers now and one of them disappeared, it would not have a material impact on your ability to maintain patient safety and deliver healthcare? Irrespective of the debate about size, what suppliers do you not determine to be critical?
Lincoln Jopp (Conservative, Spelthorne)
Q Brian, from your side, what about, say, PPE, gloves or blood? There must be other things that are non-data that are, nevertheless, essential services.
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Do you have integration with your local primary care IT systems? For example, GPs have the old EMIS system and so on; is that integrated into your network? From your perspective, would that be a critical supplier that would need to be regulated?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Does that also exist for local government? Does adult social care and so on have that integration too?
Emma Lewell (Labour, South Shields)
If there are no further questions from Members, I thank witnesses for their evidence. We will move on to the next panel.
Emma Lewell (Labour, South Shields)
We will now hear oral evidence from Chris Parker, director of government strategy at Fortinet and co-chair of the UK cyber resilience committee at techUK, and Carla Baker, senior director of government affairs in the UK and Ireland at Palo Alto Networks. For this session, we have until 4.50 pm.
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thanks for coming to give evidence this afternoon. I have two questions—one for each of you. Chris, from Fortinet’s perspective, what more do you think the Government can do to support SMEs to improve their cyber-resilience, while at the same time ensuring that the burden of regulation remains proportionate, particularly on smaller companies?
Carla, from the Palo Alto Networks perspective, what are your views on the changes to the incident reporting regime under the Bill? Will the approach help or hinder regulators in identifying and responding to the most serious threats quickly?
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q Thank you both for joining us. I have a very broad, open question: what other measures, both legislative and non-legislative, could the UK Government take to enhance the cyber-resilience of the UK’s critical national infrastructure?
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q What about workforce? One thing we have heard today from the regulators is that they are going to have to expand their teams. Reportedly, there are thousands of vacancies across cyber-security, and there is more regulation coming that they will have to comply with. What should the Government be doing to improve and expand the size of the workforce that is available to do all of this work?
Emma Lewell (Labour, South Shields)
I call Tim Roca.
Tim Roca (Labour, Macclesfield)
Sorry, Chair, I don’t have a question.
Emma Lewell (Labour, South Shields)
You don’t? Okay, I call Allison Gardner.
Allison Gardner (Labour, Stoke-on-Trent South)
Q I have loads. Before I come to the question I was going to ask, I want to pick you up on the worry about information sharing. I have worked across regulators, and they seemed to be really confident about information sharing, but I know that is not always the case. There is some protection of turf, and other Acts might prohibit that information sharing. Could you expand on that area of concern? What would be your recommendation?
Allison Gardner (Labour, Stoke-on-Trent South)
Particularly between regulators, and how that would work.
Allison Gardner (Labour, Stoke-on-Trent South)
Q Okay, I am glad I clarified, because that is quite interesting.
I will ask my actual question, and I am trying to get my head around this. You recommend mandating that company boards be accountable for mitigating cyber-risks, and as we know from the annual cyber-security breaches survey, there are declining levels of board responsibility for cyber in recent years, which links to whether there should be a statutory duty. I am a little worried about small and microbusinesses having to deal with that regulatory burden, especially if they are designated as critical suppliers. I am trying to marry those two things together, and the concern of where liability sits, because we are very dependent on service providers. I do not know if that makes any sense to you, but could you clarify my thinking?
Allison Gardner (Labour, Stoke-on-Trent South)
Q Very quickly—I apologise if I am taking too much time—accountability is slightly different from liability. In the case of a cyber-breach that has caused harm, where would you see the liability lying?
Lincoln Jopp (Conservative, Spelthorne)
Q I want to come back to that point. Chris, you said something like, “SMEs find it very difficult, if not impossible, to bear the regulatory burden, so we have to be very careful when designating SMEs as operators of essential services.” To me, that says that you think the Bill, as currently drafted, will place too much of a regulatory burden on SMEs. Is that correct?
Andrew Cooper (Labour, Mid Cheshire)
Carla, I want to come back on the potential for unnecessary over-reporting of incidents. I cannot speak for the Minister, but I am sure it is not his intention that every phishing email is reported. I was listening carefully to what you said about your proposed tiered approach, and I can imagine, say, a situation where you are United Utilities and you intercept somebody trying to put a pre-emptive virus on to one of your industrial control systems. There has been no impact on customers or your infrastructure, because you have caught it. However, I would argue that it is quite important that United Utilities share that information with the regulator and that that information is disseminated to Severn Trent, Thames Water and whoever else needs to know, so they can patch their systems, look out for the virus or find out whether they have been infected already.Q
I can imagine that the legislation has been worded as it is to try to capture that situation where activity might occur, but not have an impact. Would you accept that that is important, and how would that fit in with the tiered approach that you described?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q I would also like to ask some questions on this definition of critical supplier. I know you will have heard the questions I had for the other panel. Is there a danger, in the way this Bill is approaching definitions of critical suppliers, that a supplier may end up being deemed critical solely by virtue of supplying to a critical industry, rather than the criticality of that particular supplier in the ecosystem?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Notwithstanding other components to the criteria one may seek to use or will use, is there a danger that—although this is clearly not the intention in the drafting—through the back door, our entire economy ends up being in scope of this Bill?
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q This feels like quite a big issue to be flagging up quite late in the day. In terms of the legislative process, do you think there has been a good enough consultation process between Government and business?
Emma Lewell (Labour, South Shields)
If there are no further questions from Members, I will thank the witnesses for their evidence. We will now move on to our final panel.
Examination of Witness
Emma Lewell (Labour, South Shields)
We will now hear oral evidence from the Minister for AI and Online Safety, Kanishka Narayan. For this session, we have until 5.10 pm.
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you, Minister, for giving evidence this afternoon. I have a couple of questions. The first is about the definitions in the Bill, whether of MSPs or otherwise. All day long we have heard from representatives of different sectors of the industry, and pretty much everyone has talked about the importance of consultation on the definitions and when they are applied in secondary legislation. A certain amount of that stuff will be in primary legislation, so what consultation have you had with industry in setting up the definitions in the Bill in the first place?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Thank you, Minister, but I am not sure that you answered my question. What engagement have you had in terms of consulting with industry in setting those definitions?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q I assume that you are referring to the previous Minister, who you took over from?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Do you not think that, as the Minister taking this through the Commons, you should have also had some of those meetings and consultations?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q What conversations have you had with the Secretary of State regarding guardrails on the extensive powers in this Bill that were referred to earlier?
Ben Spencer (Conservative, Runnymede and Weybridge)
Q Do you think there is a potential need for guardrails?
Christopher Vince (Labour/Co-operative, Harlow)
Q Thank you for your time, Minister. Listening to the evidence and looking at the Bill, what strikes me is that this is about a balance between the importance of flexibility—particularly given the increase in threat and the complexity of the issues we face—and businesses wanting certainty. Do you feel confident that the Bill strikes that balance, and how have you sought to ensure that it does?
Bradley Thomas (Conservative, Bromsgrove)
Q Would the cyber-attacks on JLR and M&S that took place last year be in the scope of this Bill?
Bradley Thomas (Conservative, Bromsgrove)
Q Do you think they should be within scope?
Bradley Thomas (Conservative, Bromsgrove)
Q But would you like to see a Bill that goes further and has broader scope?
Bradley Thomas (Conservative, Bromsgrove)
Q With regard to skills, given the acute shortage and the growth of this industry, what do you propose to ensure that the public sector is adequately resourced, given what will undoubtedly be a very lucrative private sector appeal for that talent?
Tim Roca (Labour, Macclesfield)
Q The Committee heard this morning about the public sector’s level of technical debt. This Bill is important in terms of safeguarding essential services, but we heard that an important factor—notwithstanding this Bill—is tackling the enormous number of legacy systems. How do you see us running the two in parallel?
Lincoln Jopp (Conservative, Spelthorne)
Q Going back to our conversation with the head of IT security and compliance at NHS Greater Glasgow and Clyde and what could be designated an operator of essential services, and our subsequent conversation with Palo Alto, how do you envision that bit of the Bill working? Taking Glasgow as an example, while neither of us are doctors, we both broadly know what happens in hospitals—and there is also a doctor sitting to my right on the Committee, should we need one. On the example that I gave, given what is written in the Bill, how do you think it should work?
Lincoln Jopp (Conservative, Spelthorne)
I meant operators of essential services.
Lincoln Jopp (Conservative, Spelthorne)
Q Sorry, I misspoke. I mean an SME that is deemed a critical supplier. Who is going to deem them so? Which of the many regulators at play in that hospital is going to decide who is a critical supplier?
Lincoln Jopp (Conservative, Spelthorne)
Q That is a very clear answer on the steps that have to be followed. Do you envisage that each regulator in, for example, the NHS Greater Glasgow and Clyde will follow the steps from their perspective? The first one might produce 20 SMEs that need to be in scope, and the next one might produce another 20, and so on. There might be a bit of overlap. Is that the way it is meant to work, or are all the regulators meant to get together and say that they have looked at it holistically, done the step test, and now have the answer?
Lincoln Jopp (Conservative, Spelthorne)
Q To be very clear, the three regulators we had here today were the Information Commissioner, Ofgem and Ofcom. If they thought that they had a locus because of something that that hospital did, all three would do the step test, they would come up with their bucket of SMEs that they wanted to bring into scope, and those would be added together and that would be the impact.
Andrew Cooper (Labour, Mid Cheshire)
Q We have heard evidence today about the appropriateness of individual sectoral regulators being responsible for this, versus a single regulator. Perhaps unsurprisingly, the sectoral regulators were in favour of a sectoral approach, and we heard differing views from other people. The hon. Member for Bromsgrove already covered the point about whether there are sufficient skills available to staff up all the sectoral regulators to the appropriate level to adequately cover this function.
We have heard quite a bit about how important it will be, if taking a sectoral approach, to make sure that sharing information between regulators works smoothly, and that there are no information silos. The witness from Ofcom talked about an annual report to the National Cyber Security Centre. That sent chills down my spine, though I am sure she did not mean it quite in that way. How will you ensure that there is an adequate flow of information between regulators in a timely manner? They might not realise that there is cross-sectoral relevance, but when that information is provided to another regulator, it might turn out that there is. How do you address the importance of a single point of reporting that we heard about time and again from witnesses today?
Andrew Cooper (Labour, Mid Cheshire)
Q With respect, Minister, that sounds like quite a lot of, “This is what I hope will happen and this is what I wish to happen.” How will you mandate that it happens? Does there need to be something in the legislation to ensure that there is a duty of candour between regulators?
Emma Lewell (Labour, South Shields)
I think this might be the last question to the Minister.
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q I have two questions. Why have electoral services provided by local authorities not been considered as critical infrastructure?
David Chadwick (Liberal Democrat, Brecon, Radnor and Cwm Tawe)
Q Got it. The other question is about board-level responsibility. Numerous witnesses said that they would like to see more on board-level responsibility and people working within organisations, particularly chief information security officers, to strengthen their hands and make sure cyber-security measures are in place. What is your response to that?
Emma Lewell (Labour, South Shields)
Dr Allison Gardner, you have two minutes.
Allison Gardner (Labour, Stoke-on-Trent South)
Q I will be quick. Much of my question was already asked. I will just say that proportionality is a known principle within regulation and I take that into account. I want to push on an issue that was raised. When you are dealing with different regulators with a cross-regulatory theme, you often get conflicting guidelines. It is a big headache for people. Again, you get the gaps and the duplication. To ensure my understanding, who will oversee making sure that the regulators align with each other to make it easier for people working within the sectors? Otherwise, they will go to one regulator and it will say one thing, and another will say another thing.
Emma Lewell (Labour, South Shields)
That brings us to the end of the time allotted for the Committee to ask questions, and to the end of the sitting. On behalf of the Committee, I thank the Minister for his evidence.