How this links to the Cyber Security and Resilience Bill
Part 4 is entirely new. It gives the Government a direct power to intervene in any regulated organisation for national security reasons, outside the normal regulator-led NIS process. It is the only part of the Bill with a daily penalty, and its 10% of turnover limb only switches on once separate regulations are made.
- cl.43(1): the Secretary of State may direct a regulated person where a security or operational compromise, or the threat of one, gives rise to a risk to national security, and the direction is necessary and proportionate.
- cl.43(3): directions can cover system management, information, prohibitions on using or installing goods and services, removing or modifying equipment, and appointing a "skilled person".
- cl.44: compliance with a direction takes priority over a conflicting regulatory requirement once the person is notified.
- cl.48-52: contraventions are enforced by notification, confirmation decision and penalty. cl.49(3)(a) sets £100,000 a day for a continuing contravention, and cl.52 enforces non-disclosure requirements.
Who can receive a national security direction?
A direction goes to a "regulated person" in the Part 3 sense (cl.58, cl.30(2)). Clause 30(5) treats every operator of essential services, relevant digital service provider, relevant managed service provider and critical supplier as a regulated person, and future Part 3 regulations can add others who carry on an essential activity or provide an activity-critical supply.
Under cl.43(4), the national security risk does not have to relate to the essential activity itself. A direction can also require action inside or outside the UK (cl.43(3)(h)).
What safeguards apply?
The Secretary of State must consult the person, and others as appropriate, before giving a direction, unless that would be contrary to national security (cl.43(9)-(10)). A direction must state its reasons, subject to the same exception, and give a reasonable period for compliance (cl.43(5)). Directions must be kept under review (cl.54) and laid before Parliament unless that would harm national security (cl.55).
The Secretary of State can also impose non-disclosure requirements on the recipient and on anyone consulted (cl.43(11)). Clause 45 lets the Secretary of State direct a regulator to monitor compliance, and cl.46 and cl.47 give information and inspection powers. Clause 53 separately lets the Secretary of State direct regulators themselves on national security grounds.
What are the penalties?
Under cl.49(2), contravening a direction or the skilled person approval rule carries up to £17 million. Where regulations under cl.49(5) (defining an undertaking and its turnover) are in force, the maximum for an undertaking becomes the greater of £17 million and 10% of worldwide turnover. No such regulations have been made yet.
For a continuing contravention, cl.49(3)(a) adds up to £100,000 a day after a confirmation decision. Information and inspection failures under Part 4 carry £10 million and £50,000 a day, as do breaches of non-disclosure requirements (cl.52(5)). These figures belong to Part 4 only; the NIS Regulations have no daily penalty.
Common misconceptions
Myth: Part 4 directions are the same thing as vendor-related directions.
Reality: No. Vendor-related directions are a proposed Government amendment tabled for Lords Committee and are not in the printed Bill. Clause 43 already allows prohibitions on using or installing particular goods and services.
Where it appears in the Bill
- cl.43Power to give directions, kinds of requirement, consultation and non-disclosure.
- cl.44Directions take priority over conflicting regulatory requirements.
- cl.46-47Part 4 information notices and inspections.
- cl.48-52Enforcement: notification, penalty amounts, confirmation decisions, recovery and non-disclosure.
- cl.54-55Review, variation, revocation and laying before Parliament.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
When can the Secretary of State give a national security direction?
Only when the Secretary of State considers that a security or operational compromise of a relevant network and information system, or the threat of one, gives rise to a risk to national security, and that the direction is necessary and proportionate in the interests of national security (cl.43(1)). The direction must be to do, or not do, a particular thing it specifies.
Does the 10% of turnover penalty apply now?
No. Under cl.49(2)(a), the maximum for contravening a direction is £17 million. It becomes the greater of £17 million and 10% of worldwide turnover only where regulations under cl.49(5), defining an undertaking and its turnover, are in force. None have been made, and the Bill itself has not yet received Royal Assent.
Can we tell anyone we have received a direction?
Possibly not. Clause 43(11) lets the Secretary of State require a recipient not to disclose the existence or contents of a direction without permission, where that is necessary and proportionate for national security. Breach is enforced under cl.52, with a maximum of £10 million and £50,000 a day. Disclosure by an employee counts as disclosure by the organisation unless it took all reasonable steps to prevent it.