The Cyber Security and Resilience Bill, section by section

How the Bill is organised

The Cyber Security and Resilience Bill (CSRB) mostly works by amending existing law. That's why references often have two layers: a section of the Bill, and the regulation of the NIS Regulations 2018 it inserts or changes. Numbers below come from HL Bill 32 and may change.

Part 1: Introduction

Section	What it does
1	Defines "the NIS Regulations"
2	Gives an overview of the Act

Part 2: The NIS Regulations

Who is regulated

Section	What it does
3	Confirms essential service operators can be caught whether or not established in the UK, and keeps public electronic communications out of this route
4	Makes data centres an essential service regulated by Ofcom: 1 MW, or 10 MW on an enterprise basis
5	Applies data centre rules to the Crown, with exceptions for intelligence agencies and certain classified services
6	Adds large load controllers: 300 MW or more of potential electrical control
7	Redefines cloud computing and creates the "relevant digital service provider" definition
8	Updates RDSP risk management duties
9	Creates "managed service" and "relevant managed service provider"
10	Sets RMSP security duties (regulation 14B)
11	Defines "subject to public authority oversight"
12	Lets regulators designate critical suppliers (regulations 14H onwards)

Information and incidents

Section	What it does
13	Requires data centre operators to give information to their regulator
14	Sets registration and UK representative rules for RDSPs and RMSPs
15	Widens "incident" and sets 24-hour and 72-hour notifications, with copies to the CSIRT
16	Requires data centres, RDSPs and RMSPs to notify affected UK customers

Other changes

Section	What it does
17	Lets regulators charge regulated organisations to recover costs
18	Changes how regulators, GCHQ and others share and use information
19	Requires guidance on specified topics
20	Strengthens powers to require information
21	Updates financial penalties
22	Introduces Schedule 1 on enforcement and appeals
23	Introduces Schedule 2 on minor and consequential changes

Part 3: Functions of the Secretary of State

Section	What it does
24	Defines key terms and lets ministers specify essential activities and regulators
25	Allows a statement of strategic priorities
26	Sets consultation and procedure for the statement, including at least 40 days for regulators
27	Requires regulators to have regard to it and seek to achieve relevant objectives
28	Requires reports to Parliament on how regulators are doing so
29	Allows regulations on security and resilience of systems
30	Allows those regulations to impose requirements on regulated persons
31	Allows them to give regulators enforcement, sanction and appeal functions
32	Makes provision about financial penalties in those regulations
33	Allows them to cover information sharing, guidance and other functions
34	Allows them to provide for regulators recovering costs
35	Adds supplementary powers and definitions
36	Allows a code of practice recommending compliance measures
37	Sets the procedure for issuing the code, including a draft before Parliament
38	Sets its legal effect: a failure to follow it is not of itself evidence of non-compliance, but it is admissible and may be taken into account
39	Sets how a code is withdrawn
40	Requires a report to Parliament on the legislation at least every five years
41	Sets general rules for regulations under this Part
42	Sets consultation and parliamentary procedure for regulations

Part 4: Directions for national security purposes

Section	What it does
43	Lets the Secretary of State give directions to regulated persons where necessary and proportionate for national security
44	Gives directions priority over conflicting regulatory requirements, once the person is notified
45	Lets ministers direct regulators to monitor compliance
46	Sets powers to require information
47	Sets powers of inspection
48	Sets how notice of a suspected contravention is given
49	Sets maximum penalties, including £17 million, up to 10% of turnover if further regulations are in force, and daily amounts
50	Sets enforcement after representations
51	Sets how penalties are recovered across the UK
52	Applies enforcement to non-disclosure requirements
53	Lets ministers direct regulators in the interests of national security
54	Requires review of directions and allows variation or revocation
55	Requires directions to be laid before Parliament, unless contrary to national security
56	Covers information sharing
57	Sets how directions and notices are given
58	Defines terms

Part 5: General

Section	What it does
59	Extends the Act to England and Wales, Scotland and Northern Ireland
60	Sets commencement: see when the Bill comes into force
61	Sets the short title

The schedules

Schedule 1 amends the NIS Regulations on enforcement and appeals, including inspection powers extended to RMSPs. Schedule 2 contains minor and consequential amendments to the NIS Regulations and other laws.

Sources

• The Bill as brought from the Commons (HL Bill 32)
• Government factsheet: summary of the Bill