U.K. authorities on Wednesday introduced highly anticipated legislation that would create minimum cybersecurity standards for critical industries, set incident reporting deadlines and regulate certain IT services that have been the nexus of a recent wave of social engineering attacks.
The Cyber Security and Resilience Bill would allow for suppliers to critical sectors such as healthcare, water, transportation or energy to be designated as essential. They would then have to meet minimum cybersecurity standards to help prevent larger supply chain disruptions.
The plan would also regulate companies providing IT services, cybersecurity and IT help desk support to have robust security plans and to promptly report significant security incidents to the government.
If enacted, the law would create tougher penalties, including penalties based on turnover, in cases of major cyber breaches. The bill would allow penalties of up to $22.4 million (17 million pounds), or 4% of a regulated organization’s worldwide turnover. Less significant attacks would result in a lesser penalty of 2% of annual turnover.
The U.K. Technology Secretary would be given new powers to force regulators to take specific steps to boost cyber preparedness in cases of national security.
The legislation comes a month after U.K. authorities issued a grim analysis of the nation’s cyber posture. The country experienced a record 204 nationally significant attacks and 18 that were deemed highly significant incidents.
A wave of attacks have led to catastrophic impacts on the U.K. economy. A late summer cyberattack against Jaguar Land Rover cost the nation’s economy about $2.5 billion, and the government agreed to a massive loan package that would help protect the automaker’s extensive supply chain from collapsing.
“The new U.K. Cybersecurity and Resilience Bill introduces significantly tougher, turnover-based penalties and emergency government powers compared to existing NIS2 and GDPR frameworks, setting a precedent for stricter cybersecurity enforcement,” Madelein van der Hout, senior analyst at Forrester, told Cybersecurity Dive.
In September, Richard Horne, the CEO of the National Cyber Security Centre, called for a shift in focus toward business continuity, during a speech at the Billington Cybersecurity Summit in Washington, D.C.
The U.K. has seen major companies go through weeks of disruption linked to cyberattacks, including department store chain Marks & Spencer, which took at $400 million hit from an April social engineering attack.
The chairman of M&S called on UK authorities to develop a mandatory reporting requirement in the case of significant attacks.
