UK unveils new cybersecurity laws to protect vital services

LONDON

Hospitals, energy and water supplies, and transport networks across the UK will be protected from cyberattacks under new legislation introduced to parliament on Wednesday.

The Cyber Security and Resilience Bill will apply to essential sectors such as healthcare, energy, water and transport, as well as medium and large companies that provide key IT services – including cybersecurity and technical support – to both government and private organizations.

These firms will, for the first time, face direct regulation and be required to report significant cyber incidents promptly.

Regulators will also gain new powers to identify and enforce cybersecurity standards for critical suppliers – such as companies providing medical diagnostics to the NHS or chemicals to water utilities – closing potential gaps in national supply chains.

The bill introduces tougher, turnover-based penalties for serious breaches and gives the technology secretary authority to direct regulators and major organizations to take urgent action if a cyber threat poses a risk to national security.

Science, Innovation and Technology Secretary Liz Kendall said in a statement, “Cybersecurity is national security. This legislation will enable us to confront those who would disrupt our way of life. I’m sending them a clear message: the UK is no easy target.”

According to government figures, cyberattacks cost the UK economy an estimated £14.7 billion ($19.3 billion) a year, or around 0.5% of GDP.