The statement of strategic priorities explained
The statement of strategic priorities is a future document under the Cyber Security and Resilience Bill (CSRB). It would set the Government’s priorities and objectives for regulators, who would have to have regard to it. It is different from the Government’s April 2025 policy statement, which explained what would go in the Bill.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Two documents that are easy to confuse
People searching for a "policy statement" on the Cyber Security and Resilience Bill (CSRB) could mean either of these.
| Policy statement | Statement of strategic priorities | |
|---|---|---|
| What it is | A Government paper explaining what it planned to put in the Bill | A future statement under the Bill, setting priorities and objectives for regulators |
| Status | Published on 1 April 2025 and updated on 9 April 2025 | Cannot be designated until the relevant part of the Bill is in force |
| Legal effect | Explains policy. It creates no duties | Regulators would have to have regard to it |
This guide is mainly about the second one. The policy statement is now mainly useful as background, since the Bill itself has moved on through Parliament.
What the statement would contain
Section 25 of the print brought from the Commons lets the Secretary of State designate a statement setting out:
- The Government's strategic priorities on the security and resilience of network and information systems used in connection with essential activities.
- The roles and responsibilities of regulators and others involved in delivering them.
- Objectives for regulators in working towards those priorities.
How it would be made
The steps are:
- The Secretary of State prepares a draft and consults regulators, allowing at least 40 days for responses. This can happen before the section starts.
- The Secretary of State makes any changes that appear appropriate, then lays the statement before Parliament.
- A 40-day period runs. If either House resolves not to approve the statement in that time, it cannot be designated.
- If not, the Secretary of State may designate and publish it.
Periods when Parliament is dissolved or prorogued, or both Houses are adjourned for more than four days, do not count towards the 40 days in step 3.
How often it can change
Generally, a statement cannot be amended or withdrawn within three years of the latest designation. There are two exceptions: a general election, or a significant change in Government policy or in the threat, as the Secretary of State sees it. Correcting clerical errors does not count as an amendment.
What regulators must do
Under section 27, when exercising functions under the NIS Regulations and Parts 3 and 4 of the Bill, each regulatory authority must:
- Have regard to the statement.
- Seek to achieve any relevant objectives in it.
Section 28 then requires the Secretary of State to lay a report before Parliament after each 12-month reporting period, setting out in general terms how regulators have complied and how they plan to comply next. Regulators can be required to provide information for that report.
When it starts
Chapter 2 of Part 3, which holds these provisions, comes into force two months after Royal Assent under the print we reviewed. That lets designation happen early, but the Bill does not set a deadline for a first statement. See when the Bill comes into force.
Why this matters to you
The statement is addressed to regulators and places no direct duty on your organisation. It still matters for three reasons:
- It could shape enforcement priorities. It may tell you what regulators are being asked to focus on.
- It could help consistency. Today's NIS regime has many regulators. One of the statement's stated roles is to set out responsibilities across them.
- It is an early signal. A draft or final statement may show what later regulations and guidance will emphasise.
What to watch for
- A draft shared with regulators, or laid before Parliament.
- Any objectives that mention your sector, supply chains or incident reporting.
- How it aligns with regulator guidance and any code of practice.
- Whether the Lords' amendments change Part 3 before Royal Assent.
What this statement is not
It is not:
- A list of your compliance duties.
- A replacement for regulator guidance.
- A code of practice. Section 36 is a separate power for a code describing recommended measures.
- A way to change the law by itself. New requirements would come through regulations.
Sources
Frequently asked questions
A Government paper published on 1 April 2025 that set out the policy measures planned for the Bill. It explains policy, but creates no legal duties.
It is aimed at regulators, so it places no direct duty on you. It could still influence what regulators focus on.
It cannot be designated until the relevant part of the Bill is in force. The Bill as brought from the Commons brings that part into force two months after Royal Assent, but it sets no deadline for a first statement.
Yes. Under the print brought from the Commons, it cannot be designated if either House resolves not to approve it during the 40-day period after it is laid.