The Cyber Security and Resilience Bill in Scotland, Wales and Northern Ireland
The Cyber Security and Resilience Bill (CSRB) extends to the whole UK, so scope does not depend on which nation you are in. What can differ is your regulator, and for some energy services in Northern Ireland, the threshold. This guide sets out both by sector.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short version
Section 59 extends the Cyber Security and Resilience Bill (CSRB) to England and Wales, Scotland and Northern Ireland. New duties on managed service providers, data centres, load controllers and critical suppliers don't depend on your nation. The parliamentary consent process is covered in our legislative consent article. This guide focuses on the practical differences.
Who regulates what
This table comes from Schedule 1 to the NIS Regulations 2018. The Bill adds data infrastructure, regulated by Ofcom across the UK.
| Sector | England | Wales | Scotland | Northern Ireland |
|---|---|---|---|---|
| Electricity | Energy Secretary and GEMA, jointly | Same | Same | Department of Finance |
| Oil | Energy Secretary | Same | Same | Department of Finance |
| Gas | Energy Secretary, jointly with GEMA for most services | Same | Same | Department of Finance |
| Air transport | Transport Secretary and CAA, jointly | Same | Same | Same |
| Water transport | Transport Secretary | Same | Same | Same |
| Rail | Transport Secretary | Same | Same | Department of Finance |
| Road | Transport Secretary | Same | Scottish Ministers | Department of Finance |
| Health care | Health Secretary | Welsh Ministers | Scottish Ministers | Department of Finance |
| Drinking water | Environment Secretary | Welsh Ministers | Drinking Water Quality Regulator for Scotland | Department of Finance |
| Digital and data infrastructure | Ofcom | Ofcom | Ofcom | Ofcom |
| RDSPs and RMSPs | Information Commission | Same | Same | Same |
In England and Wales, the Drinking Water Inspectorate carries out the operational regulator work for drinking water on behalf of the ministers.
Thresholds that differ
Most thresholds apply across the UK, but several energy thresholds in Schedule 2 are lower in Northern Ireland, because its market is smaller. A business can therefore be in scope there while a similar one in Great Britain is not.
| Service | Great Britain | Northern Ireland |
|---|---|---|
| Electricity supply | More than 250,000 final customers | More than 8,000 consumers |
| Gas supply | More than 250,000 final customers | More than 2,000 customers |
| Oil transmission by pipeline | More than 500,000 tonnes a year | More than 50,000 tonnes a year |
| Electricity distribution | Could disrupt supply to more than 250,000 customers | Holder of the distribution licence |
Healthcare also has no numeric threshold. It names NHS bodies by nation, such as Local Health Boards and NHS Trusts in Wales, and Health and Social Care Trusts in Northern Ireland.
Working across borders
An operator in more than one nation may answer to more than one authority. A health or water business should check each location against the table. For critical suppliers, the Bill says more than one authority can designate the same person, and the government says regulators will coordinate.
If you report an incident, send it to the authority responsible for the affected service. Regulators will set the form and manner of notifications, and may do so differently. Do not assume one notification portal covers all nations until published guidance confirms it.
Regulations can vary by area
Section 41 lets regulations made under Part 3 make different provision for different areas. Future requirements could therefore differ by nation, so check secondary legislation as it appears.
Frameworks in the devolved nations
Searches about the Cyber Assessment Framework in Scotland are common. The CAF is an NCSC framework used across the UK. Whether and how you are assessed against it depends on your regulator, so ask your regulator what it expects. The Department of Finance publishes NIS oversight information for Northern Ireland.
Sources
Frequently asked questions
Yes. Section 59 extends it to England and Wales, Scotland and Northern Ireland. Health, road transport and drinking water have Scottish regulators.
The Welsh Ministers are the designated competent authority for the health sector in Wales.
The NIS Regulations 2018 name the Department of Finance as the competent authority for several Northern Ireland sectors, including energy, rail, road transport, health and drinking water.
Legislative consent is a process between parliaments. Check the final Act, but our existing analysis is that withholding consent would not itself carve an in-scope organisation out.