National security directions explained

What a national security direction is

Part 4 of the Cyber Security and Resilience Bill (CSRB) lets the Secretary of State give a binding instruction directly to a regulated organisation, without going through its normal regulator. It is a new power, separate from day-to-day regulation, and it applies where a cyber or operational risk creates a risk to national security.

Most organisations will probably never receive one. But the consequences are serious enough that regulated organisations should know who would handle it.

When a direction can be given

Under clause 43, the Secretary of State must consider both of the following:

1. A security or operational compromise of a relevant network and information system, or the threat of one, gives rise to a risk to national security.
2. The direction is necessary and proportionate in the interests of national security.

The risk does not have to relate to the essential activity itself, so a broader national security concern can qualify.

What a direction can require

A direction requires the organisation to do, or not do, a particular thing. The Bill's examples include:

• requirements on how relevant systems are managed
• steps to reduce risk or limit impact on an essential activity or critical supply
• providing information, including about compliance
• prohibiting or restricting the use of goods, services or facilities
• prohibiting installation of goods or taking up of services or facilities
• removing, disabling or modifying goods or facilities, or modifying services
• appointing a skilled person with security expertise
• acting in the UK, relevant UK waters or elsewhere

That list is not exhaustive. The goods and services items are why this power overlaps with the vendor direction proposals.

What the Government must and need not do

Safeguard	What the Bill says	The limit
Reasons	The direction must give reasons	Reasons can be withheld where disclosure would be contrary to national security
Consultation	The recipient and others must be consulted where reasonably practicable	Consultation can be dropped on the same national security ground
Timing	It must state when it starts and give a reasonable period for each requirement	What is reasonable depends on the case
Secrecy	The recipient can be barred from disclosing the direction	The bar must be necessary and proportionate
Parliament	Clause 55 covers laying directions before Parliament	Check the final text for exceptions
Review	Clause 54 covers review, variation and revocation	Check the final text for the process

Penalties

These penalties differ from the regular penalty bands under the NIS Regulations, which are described in fines and penalties.

Contravention	Maximum
Breaching a direction (undertaking)	£17 million, or the greater of £17 million and 10% of worldwide turnover once regulations under clause 49(5) are in force
Breaching a direction (not an undertaking)	£17 million
Information or inspection failures	£10 million
Continuing breach of a direction	Up to £100,000 a day
Continuing information or inspection failures	Up to £50,000 a day

The 10% figure only applies once those further regulations exist, so do not treat it as automatic.

If a direction conflicts with other rules

Under clause 44, if the Secretary of State decides it is not reasonably practicable to comply with both a direction and another regulatory requirement, and notifies you, the other requirement does not apply so far as it conflicts. That relief depends on the notification, so raise any conflict quickly. Contract clashes are a different matter, so check those separately.

Skilled persons

A direction may require you to appoint a skilled person. Even if it does not, approval from the Secretary of State is required in writing before you appoint one for the purpose of complying. The Secretary of State may rely on a list published by GCHQ. You must also give notice as soon as reasonably practicable after any appointment. You can't simply bring in your usual consultant.

Directions to regulators

Clause 53 also lets the Secretary of State direct a regulator about how it exercises its functions, where necessary and proportionate for national security. A regulator's position might therefore change for reasons it cannot fully explain to you.

How to prepare

1. Name a contact. Decide who would receive a direction at any time, and a deputy.
2. Limit who knows. Prepare a need-to-know process, because a non-disclosure requirement could stop you telling colleagues, customers or investors.
3. Know how to reach legal support quickly. Take advice on the process, and on any disclosure duties that may conflict.
4. Map your suppliers and systems. You could be asked to remove, disable or restrict a product at short notice.
5. Test emergency change. Find out how quickly you could make a major change safely.
6. Review contracts. Check whether a legal direction allows you to suspend or end a supplier contract.
7. Keep compliance records. A direction can include requirements to provide information on compliance.

When this starts

Part 4 is not on the Bill's lists of provisions starting at Royal Assent or two months later, so it depends on commencement regulations. See when the Bill comes into force. A Lords amendment on a register of foreign powers is also tied to these powers.

Sources

• The Bill as brought from the Commons (HL Bill 32), clauses 43 to 58
• GOV.UK: power to direct regulated entities factsheet
• GOV.UK: power to direct regulators factsheet
• Glossary: national security direction