The government has outlined proposals for new powers under the Cyber Security and Resilience Bill aimed at boosting cyber defences for the UK's essential services.
With hostile cyber attacks and sabotage on essential services like energy, water, transport, and healthcare on the rise globally, vendors and companies with connections to hostile states pose a 'growing and serious' threat to the UK’s security.
The idea is for the government to be able to step in when essential service providers are looking to buy equipment or technology from suppliers that could pose a critical national security risk.
"These new powers mean we can act before a threat materializes, not just after the damage is done. By working together with industry, we're putting national security at the heart of how essential services choose their suppliers," said cyber security minister Liz Lloyd.
"This is about staying ahead of a growing threat, and giving the public confidence that the everyday services we depend on like water and energy supplies, our transport network and hospitals, are protected."
New cyber safe procurement guidance would be made available for all essential service providers to help them secure their supply chains. Providers will be able to refer themselves for a risk assessment if they're unsure about a vendor – and be given advice on how to mitigate any risks.
Meanwhile, the package would grant the government new legal powers to issue binding directions to essential service providers, including requiring extra security measures, a phased withdrawal, or in the most serious cases, an outright ban on acquiring a vendor or supplier's products or services.
Growing state-backed threats
The proposals come amidst growing concerns over the impact of state-sponsored cybersecurity threats.
Earlier this year, the National Cyber Security Centre (NCSC) warned that the UK is experiencing increased threats from Iranian-backed cyber groups, with a heightened risk of indirect threats for organizations with a presence, or supply chains, in the Middle East.
Government figures indicate that an outage caused by a cyber attack on London and Southeast England's electricity networks could potentially cost the economy up to £442 billion over the following five years.
Just this week, the vulnerability of key UK infrastructure was brought into focus by the news that Iranian-linked hackers were been able to knock a small power plant offline for four days.
The attack, which targeted internet-exposed programmable logic controllers (PLCs), is believed to be the first of its kind in the UK.
The amendments to the bill were laid before Parliament on Monday, ahead of Lords Committee stage scrutiny, which is set to begin in September.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
US lawmakers say CISA cuts raise ‘serious concerns about the agency's ability to fulfil its mission’
Semiconductor revenue doubles as AI data center build-outs surge
