How this links to the Cyber Security and Resilience Bill
Much of what the Cyber Security and Resilience Bill will require is not in the Bill itself but in regulations still to be made. Most of Part 2 commences only when the Secretary of State appoints a day, and Part 3 is a framework that does nothing until regulations fill it in. That is why Lords scrutiny of delegated powers has been a recurring theme.
- Clause 60(3) leaves commencement of most provisions, including the Part 2 NIS amendments, to regulations.
- Clause 24(3) lets regulations specify new essential activities.
- Clause 29(1) is the central power to make regulations about the security and resilience of relevant systems.
- Clause 42(5) requires draft affirmative approval where consultation is required or primary legislation is amended; clause 42(6) applies the negative procedure otherwise.
- Some powers can amend primary legislation, including the Bill itself. These are Henry VIII powers.
Which parts of the Bill depend on secondary legislation?
The main powers are:
- Commencement regulations under clause 60(3), with transitional provision under clause 60(7).
- Regulations specifying essential activities (clause 24(3)) and designating regulatory authorities (clause 24(6)).
- Part 3 regulations under clause 29(1), which can impose requirements on regulated persons and set enforcement, appeals, penalties and cost recovery (clauses 30 to 34).
- Regulations under clause 49(5) that would bring the 10% of turnover maximum into force for Part 4 national security directions.
- Powers to change the code of practice procedure (clause 37(7)) and the matters covered in the five-yearly report (clause 40(5)).
How much Parliamentary control is there?
Clause 42(1) requires consultation before regulations specifying essential activities, designating regulatory authorities, or making key clause 29(1) provision such as requirements, appeals, penalty maximums and cost recovery. Those regulations, and any that amend primary legislation, need a draft approved by each House (the affirmative procedure). Other Part 3 regulations are subject to annulment by either House (the negative procedure).
Parliament can approve or reject a statutory instrument but cannot amend it. That is why peers have pressed on how widely these powers are drawn.
Are the NIS Regulations themselves secondary legislation?
Yes. The NIS Regulations 2018 are a statutory instrument, SI 2018/506. Part 2 of the Bill amends them directly by primary legislation. Clause 60(6) also contemplates future clause 29(1) regulations amending the NIS Regulations to impose requirements on providers of activity-critical supplies.
Many NIS details are therefore likely to change through statutory instruments over time, alongside regulator guidance. The code of practice under clause 36 is different again: it is not a statutory instrument, but a document laid before Parliament for 40 days under clause 37 and then published.
Common misconceptions
Myth: All the duties start when the Bill becomes an Act.
Reality: Only Part 1, parts of Part 3, clause 40 and Part 5 commence on Royal Assent. The Part 2 duties, including incident reporting and the new penalty bands, start on days appointed by regulations.
Where it appears in the Bill
- Clause 24(3), (6)Regulations specifying essential activities and regulatory authorities.
- Clause 29(1)Central Part 3 regulation-making power.
- Clause 42Consultation duty and affirmative or negative procedure.
- Clause 60(3)-(7)Commencement and transitional regulations.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Why does the Cyber Security and Resilience Bill rely so much on secondary legislation?
The Government wants to be able to adjust the regime as threats and technology change without passing a new Act each time. The Bill therefore sets a framework and lets the Secretary of State fill in detail by regulations, including new essential activities and Part 3 requirements. Critics in the Lords have questioned how broad some of these powers are.
Can Parliament change regulations made under the Bill?
Parliament can approve or reject statutory instruments but cannot amend them. Under clause 42, regulations that require consultation or amend primary legislation need approval by each House before they are made. Other Part 3 regulations can be annulled by either House after they are laid. Commencement regulations are statutory instruments with no Parliamentary procedure specified.
When will the secondary legislation be made?
Not until after Royal Assent, which is expected between late 2026 and spring 2027. The Government has indicated that most duties will be phased in through regulations over the following period, towards 2028. Organisations should watch for consultations, since clause 42 requires them before the most significant Part 3 regulations.