# Part 4 of the Cyber Security and Resilience Bill (CSRB): Directions for national security purposes (Clauses 44 to 67)

> Part 4 would let the Secretary of State give binding national security directions: vendor-related directions about a supplier's goods or services, and general directions where a compromise threatens national security. Breaches could cost up to £17m (the greater of £17m and 10% of turnover once regulations exist) plus daily penalties. It adds a regime review and foreign powers register.

Canonical page: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions
Last updated: 2026-11-09 · Source print: HL Bill 62, as amended on Report (26 October 2026)

## Where this stands

This is a Bill, not law. It has not received Royal Assent, so every duty described here is proposed. Lords stages complete (Third Reading 2 November 2026). The Commons has not yet considered the Lords amendments.

Clause numbers, subsections and page numbers refer to HL Bill 62 (as amended on Report, printed 26 October 2026): https://bills.parliament.uk/publications/68323/documents/8979. Checked against the Parliament Bills API on 9 November 2026. Numbers can change if the Commons amends or rejects Lords amendments.

"What the Bill says" is a close paraphrase of the clause text. "What this means in practice" is our interpretation.

## Clause table

| Clause | Heading | What it does | Who it affects |
| --- | --- | --- | --- |
| [44](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-44) | Vendor-related directions | Directions to deal with a national security risk from using another person's goods, services or facilities. | Persons specified in affirmative regulations (regulated persons, Part 4 essential activities, essential suppliers) |
| [45](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-45) | Further provision about giving of vendor-related directions | Content of a vendor-related direction, duty to comply, skilled-person approval, consultation and secrecy. | Recipients of vendor-related directions and the vendors concerned |
| [46](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-46) | Power to make regulations about time frame for giving vendor-related directions | Regulations may set deadlines for deciding whether to give a vendor-related direction. | Persons who refer, or may be subject to, vendor-related directions |
| [47](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-47) | Power to establish mandatory referral scheme | Regulations may require specified persons to refer qualifying transactions to the Secretary of State. | Persons specified under clause 44 entering into qualifying transactions |
| [48](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-48) | General directions | Directions where a compromise, or threat of one, to a Part 4 system gives rise to a national security risk. | Regulated persons and other persons specified in affirmative regulations |
| [49](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-49) | Compliance with directions under section 44 or 48 to take priority | Where a direction conflicts with another regulatory requirement, the direction takes priority once notified. | Recipients of directions; their other regulators |
| [50](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-50) | Monitoring by regulatory authorities | The Secretary of State may direct a regulator to gather information and report on compliance with a direction. | Regulators; recipients of directions |
| [51](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-51) | Information gathering | Information notices for Part 4 purposes from the Secretary of State or a monitoring regulator. | Any person (Secretary of State); regulated persons (regulators) |
| [52](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-52) | Inspections | Inspections to verify compliance with directions, which the inspected person may have to pay for. | Recipients of directions and confirmation decisions |
| [53](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-53) | Notification of contravention | The first enforcement step: a notification setting out the contravention, steps required and proposed penalty. | Recipients of directions, information notices and inspection requirements |
| [54](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-54) | Penalty amounts | Up to £17m for breaching a direction (greater of £17m and 10% once regulations are made), plus daily penalties. | Recipients of directions and Part 4 information or inspection requirements |
| [55](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-55) | Enforcement of notification | After representations, a confirmation decision can require action and payment, enforceable in court. | Persons given a clause 53 notification |
| [56](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-56) | Enforcement of penalty | Penalties are recoverable as if payable under a county court order (or Scottish/NI equivalents). | Persons given a penalty under clause 55 |
| [57](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-57) | Enforcement of non-disclosure requirements | Breaching a Part 4 secrecy requirement can lead to penalties up to £10m (£50,000 a day). | Recipients of directions and anyone consulted on them, and their staff |
| [58](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-58) | Power to direct regulatory authorities | The Secretary of State may direct regulators on their functions, for national security. | Regulators (not Ministers, devolved governments or NI departments) |
| [59](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-59) | Review, variation and revocation of directions | Directions must be reviewed from time to time and may be varied or revoked. | Recipients of directions under clauses 44, 48 and 58 |
| [60](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-60) | Publication of notice of direction under section 44 etc | Notice of each vendor-related direction, variation or revocation must be published, with redactions allowed. | Recipients of vendor-related directions; vendors; the public |
| [61](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-61) | Annual report in relation to directions under section 44 | An annual report to Parliament on the number and kinds of vendor-related directions. | Parliament |
| [62](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-62) | Laying before Parliament: directions under sections 48 and 58 etc | Copies of general directions, directions to regulators and variations must be laid before Parliament, with exceptions. | Parliament; recipients of directions |
| [63](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-63) | Information sharing | Part 4 information may be shared with regulators, GCHQ, UK and overseas public authorities for national security. | Anyone whose information is obtained under Part 4 |
| [64](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-64) | Means of giving directions, notices etc | Directions and notices can be given by hand, post, email or via a notified UK representative. | Recipients of Part 4 directions and notices |
| [65](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-65) | Interpretation of Part 4 | Defines "Part 4 essential activity", "essential goods or services" and "Part 4 NIS". | Drafting provision |
| [66](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-66) | Review of the effectiveness of the NIS regime | A review within 12 months of Royal Assent of the regime and whether to add sectors, then annual reviews. It sits in Part 4, so on the HL Bill 62 text it commences only by regulations. | Government; potentially sectors not currently in scope |
| [67](https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-67) | Register of foreign powers for the purposes of Part 4 | A register of foreign powers posing a risk to UK critical systems, within six months of Royal Assent. It sits in Part 4, so on the HL Bill 62 text it commences only by regulations. | Government; indirectly OES and critical suppliers using vendors linked to listed states |

## Chapter 1: Vendor-related directions etc

### Clause 44: Vendor-related directions

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-44 · Affects: Persons specified in affirmative regulations (regulated persons, Part 4 essential activities, essential suppliers) · Official text: HL Bill 62, PDF page 76 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=76)

**What the Bill says**

The Secretary of State may give a direction to a person (P) specified, or of a description specified, in regulations, if two conditions are met: the Secretary of State considers a national security risk arises or could arise from P's use, in connection with its Part 4 systems, of goods, services or facilities provided by another person (condition 1); and the direction is necessary and its requirements proportionate (condition 2) (clause 44(1), (3) and (4)).

Regulations may only specify persons who are regulated persons under clause 30(2), carry on a Part 4 essential activity in the UK, or provide essential goods or services (clause 44(2)). The regulations need consultation and approval by both Houses (clause 44(7) and (9)).

A direction may require P to do or not do something to eliminate, reduce or mitigate the risk, including restricting or prohibiting use or installation of goods, services or facilities, removing, disabling or modifying them, providing information, and appointing a "skilled person" (clause 44(5) and (6)).

**What this means in practice (our interpretation)**

Our reading: this is the "high-risk vendor" power. It works on the customer (P), not the vendor directly, and could require an organisation to stop using or rip out a supplier's product. No one can receive a vendor-related direction until regulations specifying who is covered have been approved.

**History.** Inserted at Lords Report stage (26 October 2026) on a Government amendment, with clauses 45 to 47, 60 and 61. Part 4 was renumbered as a result.

Related: [Vendor direction powers](https://cybersecurityandresiliencebill.com/guides/vendor-direction-powers) · [Glossary: vendor-related direction](https://cybersecurityandresiliencebill.com/glossary/vendor-related-direction) · [Glossary: national security direction](https://cybersecurityandresiliencebill.com/glossary/national-security-direction)

### Clause 45: Further provision about giving of vendor-related directions

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-45 · Affects: Recipients of vendor-related directions and the vendors concerned · Official text: HL Bill 62, PDF page 77 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=77)

**What the Bill says**

It does not matter whether the vendor is in the UK, the goods or services are provided from outside the UK, or the use is in the UK (clause 45(1)). A direction must name the recipient, the vendor and the goods, services or facilities, give reasons (unless contrary to national security), the start time, and a reasonable period for each requirement (clause 45(2)).

The recipient must comply (clause 45(3)), must get written approval before appointing a skilled person and notify the appointment (clause 45(4)); the Secretary of State may rely on a list published by GCHQ (clause 45(5)).

Before giving a direction the Secretary of State must, so far as reasonably practicable, consult the recipient, the vendor and others, unless contrary to national security (clause 45(6) and (7)), and may require the recipient and those consulted not to disclose the direction or consultation where necessary and proportionate for national security (clause 45(8) and (9)).

### Clause 46: Power to make regulations about time frame for giving vendor-related directions

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-46 · Affects: Persons who refer, or may be subject to, vendor-related directions · Official text: HL Bill 62, PDF page 78 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=78)

**What the Bill says**

The Secretary of State may make regulations about the time frame for deciding whether to give a direction under clause 44, whether on a referral or otherwise, including the decision period and when it can be extended or paused. They are subject to annulment by either House.

### Clause 47: Power to establish mandatory referral scheme

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-47 · Affects: Persons specified under clause 44 entering into qualifying transactions · Official text: HL Bill 62, PDF page 79 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=79)

**What the Bill says**

The Secretary of State may by regulations establish a scheme requiring persons specified under clause 44(1)(a) to refer a "qualifying transaction" (including a proposed one) so the Secretary of State can decide whether to give a vendor-related direction, but only if this is considered necessary or expedient for national security (clause 47(1) to (3)). "Qualifying transaction" would be defined in the regulations, for example by nature, value, criticality or vendor identity (clause 47(4) and (5)).

The regulations may cover timing, procedure, information, monitoring and enforcement, applying clauses 50 to 57 (clause 47(6) and (7)). They need consultation and approval by both Houses (clause 47(8) and (10)).

**What this means in practice (our interpretation)**

Our reading: this would work somewhat like a procurement screening regime: in-scope organisations could have to clear certain supplier contracts before signing. Its scope is entirely for the regulations.

**Not settled by the text.** Which transactions qualify, and the thresholds, are left to regulations that have not been published.

Related: [Vendor direction powers](https://cybersecurityandresiliencebill.com/guides/vendor-direction-powers)

## Chapter 2: General directions

### Clause 48: General directions

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-48 · Affects: Regulated persons and other persons specified in affirmative regulations · Official text: HL Bill 62, PDF page 80 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=80)

**What the Bill says**

The Secretary of State may give a direction if the occurrence or threat of a security or operational compromise to a person's Part 4 system gives rise to a national security risk, and the direction is necessary and proportionate (clause 48(1)). It can be given to regulated persons under clause 30(2), or persons specified in affirmative regulations who carry on a Part 4 essential activity in the UK or provide essential goods or services (clause 48(2), (3), (6) and (17)).

Clause 48(5) lists the kinds of requirement (system management, risk reduction, information, restrictions and prohibitions on goods or services, removal or modification, a skilled person, and action in or outside the UK). Clause 48(8) sets what a direction must specify; clause 48(9) imposes the duty to comply; clause 48(10) and (11) cover skilled-person approval; clause 48(12) and (13) consultation; and clause 48(14) and (15) non-disclosure requirements.

**What this means in practice (our interpretation)**

Our reading: this is the general emergency-style power. Subsection numbers changed in the Lords: in HL Bill 32 (clause 43) the kinds of requirement were in subsection (3) and non-disclosure in (11). Check the print before citing a subsection.

Related: [National security directions](https://cybersecurityandresiliencebill.com/guides/national-security-directions) · [Glossary: national security direction](https://cybersecurityandresiliencebill.com/glossary/national-security-direction)

## Chapter 3: Directions under sections 44 and 48: supplementary provision

### Clause 49: Compliance with directions under section 44 or 48 to take priority

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-49 · Affects: Recipients of directions; their other regulators · Official text: HL Bill 62, PDF page 83 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=83)

**What the Bill says**

If the Secretary of State considers it is not reasonably practicable to comply with both a direction and another regulatory requirement under any enactment, and notifies the person, the conflicting requirement does not apply to the extent of the conflict (clause 49(1) and (2)). Relevant regulators must be told unless contrary to national security, and told again if the direction is varied or revoked.

### Clause 50: Monitoring by regulatory authorities

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-50 · Affects: Regulators; recipients of directions · Official text: HL Bill 62, PDF page 84 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=84)

**What the Bill says**

The Secretary of State may direct a regulator to obtain information about a person's compliance with a clause 44 or 48 direction, report on it and hand over the underlying information. A regulator that is a Minister, devolved government or Northern Ireland department cannot be directed but may be asked (clause 50(8) and (9)). The Secretary of State may disclose the reports, having regard to commercially and personally sensitive information.

### Clause 51: Information gathering

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-51 · Affects: Any person (Secretary of State); regulated persons (regulators) · Official text: HL Bill 62, PDF page 85 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=85)

**What the Bill says**

The Secretary of State may require any person to provide information or documents reasonably required for Part 4 functions; a regulator may require a regulated person to do so for a clause 50 direction or request (clause 51(1) and (2)). Notices must explain why, unless contrary to national security, and may require information to be generated or retained, including information stored outside the UK. Legally privileged communications are protected. The power cannot be used against the SPOC or the CSIRT.

Related: [Glossary: information notice](https://cybersecurityandresiliencebill.com/glossary/information-notice)

### Clause 52: Inspections

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-52 · Affects: Recipients of directions and confirmation decisions · Official text: HL Bill 62, PDF page 86 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=86)

**What the Bill says**

The Secretary of State, or a monitoring regulator, may carry out an inspection, appoint an inspector, or direct the person to appoint an approved inspector (clause 52(2) and (3)). The person must pay the reasonable costs if required, co-operate, give access to premises (not private dwellings), documents and people, and comply with the inspector's requests (clause 52(4) and (6)). Inspectors may require material to be preserved, copy or remove documents and equipment, interview people and carry out security tests (clause 52(8)). Powers over premises, equipment and people do not extend outside the UK (clause 52(10)).

Related: [Regulator inspections](https://cybersecurityandresiliencebill.com/guides/regulator-inspections)

### Clause 53: Notification of contravention

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-53 · Affects: Recipients of directions, information notices and inspection requirements · Official text: HL Bill 62, PDF page 88 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=88)

**What the Bill says**

Where there are reasonable grounds to believe a relevant requirement (a direction, skilled-person approval, an information notice or an inspection requirement) has been contravened, the enforcement authority may give a notification setting out the contravention, a period for representations, the steps to take and the proposed penalty (clause 53(1) to (3)). Continuing contraventions can attract daily penalties after a confirmation decision (clause 53(6)). It does not matter whether the conduct happened in the UK (clause 53(8)). The notification can be made confidential on national security grounds (clause 53(9) and (10)).

### Clause 54: Penalty amounts

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-54 · Affects: Recipients of directions and Part 4 information or inspection requirements · Official text: HL Bill 62, PDF page 90 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=90)

**What the Bill says**

A penalty must be appropriate and proportionate (clause 54(1)). Maximums (clause 54(2)):

- contravening a direction, or the skilled-person approval duty, by an undertaking: £17,000,000, or, where regulations under clause 54(5) are in force, the greater of £17,000,000 and 10% of worldwide turnover;
- the same contravention by a person that is not an undertaking: £17,000,000;
- breaching a Part 4 information or inspection requirement: £10,000,000.

Daily penalties (clause 54(3)): up to £100,000 a day for continuing contravention of a direction, and £50,000 a day for information or inspection requirements, not counting days before the notification (clause 54(4)).

The Secretary of State must make regulations defining "undertaking" and how turnover is determined (clause 54(5)); they are subject to annulment (clause 54(9)).

**What this means in practice (our interpretation)**

Our reading: until the clause 54(5) regulations exist, the cap for an undertaking is a flat £17m. The clause says the regulations "must" be made but sets no deadline.

**Not settled by the text.** There is no deadline for the clause 54(5) regulations, so when the 10% turnover cap becomes available is not known.

Related: [Fines and penalties](https://cybersecurityandresiliencebill.com/fines-and-penalties)

### Clause 55: Enforcement of notification

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-55 · Affects: Persons given a clause 53 notification · Official text: HL Bill 62, PDF page 92 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=92)

**What the Bill says**

After the representation period the authority may give a confirmation decision, with reasons, if satisfied the contravention occurred, or say no further action will be taken. The decision may require immediate action or set a period, and may impose the notified penalty or a lesser one. The duty to comply can be enforced by injunction, specific performance (Scotland) or other relief, and can be made confidential on national security grounds.

### Clause 56: Enforcement of penalty

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-56 · Affects: Persons given a penalty under clause 55 · Official text: HL Bill 62, PDF page 93 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=93)

**What the Bill says**

A penalty is recoverable in England and Wales as if payable under a county court order, in Scotland like a registered decree arbitral, and in Northern Ireland as if under a county court order, and is entered on the relevant register of judgments.

### Clause 57: Enforcement of non-disclosure requirements

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-57 · Affects: Recipients of directions and anyone consulted on them, and their staff · Official text: HL Bill 62, PDF page 94 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=94)

**What the Bill says**

Non-disclosure requirements under clauses 45(8), 48(14), 53(9) and 55(9) are enforceable through clauses 53 to 56 with modifications. A disclosure by an employee or person engaged in the business counts as the organisation's disclosure unless it took all reasonable steps to prevent it. Maximum penalty £10,000,000, or £50,000 a day for continuing contraventions.

**What this means in practice (our interpretation)**

Our reading: organisations that receive a direction will need tight internal handling, because a leak by staff is treated as their own breach unless they can show reasonable steps.

## Chapter 4: Directions to regulatory authorities

### Clause 58: Power to direct regulatory authorities

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-58 · Affects: Regulators (not Ministers, devolved governments or NI departments) · Official text: HL Bill 62, PDF page 95 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=95)

**What the Bill says**

Where necessary and proportionate in the interests of national security, the Secretary of State may direct a regulator about its functions under the NIS Regulations, clause 29 regulations or Part 4, generally or specifically. The regulator must comply. Ministers of the Crown, the Scottish and Welsh Governments and Northern Ireland departments cannot be directed.

## Chapter 5: General provision

### Clause 59: Review, variation and revocation of directions

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-59 · Affects: Recipients of directions under clauses 44, 48 and 58 · Official text: HL Bill 62, PDF page 96 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=96)

**What the Bill says**

The Secretary of State must review directions from time to time and may vary them (only if the varied direction is necessary and proportionate) or revoke them, giving notice. Before varying a clause 44 or 48 direction the Secretary of State must consult the recipient so far as reasonably practicable, unless contrary to national security, and may impose non-disclosure requirements on those consulted.

### Clause 60: Publication of notice of direction under section 44 etc

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-60 · Affects: Recipients of vendor-related directions; vendors; the public · Official text: HL Bill 62, PDF page 97 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=97)

**What the Bill says**

The Secretary of State must publish, as soon as practicable, notice that a vendor-related direction has been given, varied or revoked, stating when it takes effect, the recipient, a summary of it, its effect and reasons. Material that might unreasonably harm commercial interests or would be contrary to national security may be left out.

**History.** Inserted at Lords Report stage on a Government amendment.

### Clause 61: Annual report in relation to directions under section 44

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-61 · Affects: Parliament · Official text: HL Bill 62, PDF page 97 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=97)

**What the Bill says**

For each 12 months from when clause 44(1) comes into force (other than for making regulations), the Secretary of State must lay a report giving the number of vendor-related directions given, varied and revoked, and the kinds of services provided by the recipients (including sectors).

**History.** Inserted at Lords Report stage on a Government amendment.

### Clause 62: Laying before Parliament: directions under sections 48 and 58 etc

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-62 · Affects: Parliament; recipients of directions · Official text: HL Bill 62, PDF page 98 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=98)

**What the Bill says**

Copies of clause 48 and 58 directions and notices of variation must be laid before Parliament, unless the Secretary of State considers that contrary to national security; commercially harmful or security-sensitive material may be excluded.

### Clause 63: Information sharing

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-63 · Affects: Anyone whose information is obtained under Part 4 · Official text: HL Bill 62, PDF page 98 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=98)

**What the Bill says**

The Secretary of State and regulators may disclose information obtained under Part 4 to each other, GCHQ, other UK public authorities and overseas public authorities, where necessary for national security and limited to what is relevant and proportionate. This overrides confidentiality obligations but not the Investigatory Powers Act 2016 prohibitions.

### Clause 64: Means of giving directions, notices etc

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-64 · Affects: Recipients of Part 4 directions and notices · Official text: HL Bill 62, PDF page 99 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=99)

**What the Bill says**

Directions, notices, notifications and decisions may be delivered by hand, left at or posted to the proper address, emailed, or given to a notified representative. Email is treated as received at 9am on the next working day unless the contrary is proved.

### Clause 65: Interpretation of Part 4

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-65 · Affects: Drafting provision · Official text: HL Bill 62, PDF page 101 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=101)

**What the Bill says**

A "Part 4 essential activity" is one the Secretary of State considers essential to the UK economy or day-to-day functioning of society; "essential goods or services" are those without which such an activity would be at risk of disruption; a "Part 4 NIS" is a network and information system used for such an activity or supply, or associated with one.

**What this means in practice (our interpretation)**

Our reading: unlike Part 3, a "Part 4 essential activity" does not have to be specified in regulations first. It turns on what the Secretary of State considers essential, which gives Part 4 a potentially wider reach than the regulated sectors.

### Clause 66: Review of the effectiveness of the NIS regime

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-66 · Affects: Government; potentially sectors not currently in scope · Official text: HL Bill 62, PDF page 102 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=102)

**What the Bill says**

The Secretary of State must, within 12 months of Royal Assent, review the effectiveness of the Act and the NIS Regulations (clause 66(1)), including which organisations should have obligations, technology providers' obligations, and regulatory options (clause 66(2)).

The review must consider whether to add sectors, with particular regard to critical national infrastructure; digital infrastructure including cloud, SaaS and content delivery networks; frontier AI and agentic technologies; democratic processes; advanced manufacturing, life sciences and critical transport equipment; and education, research and large-scale retail of essential goods other than food (clause 66(3)). It must also look at thresholds, supply chains, the regulatory framework, powers for the AI Security Institute over frontier AI, cyber skills supply and incident reporting timelines (clause 66(4) and (5)).

A report must be laid; where it concludes an activity should be brought in, the Secretary of State must within six months lay draft regulations or explain why not; further reviews follow at intervals of not more than 12 months (clause 66(8) to (10)).

**History.** Inserted at Lords Report stage on a non-Government amendment (amendment 163, Lord Birt, Lord Markham, Lord Clement-Jones and Baroness Kidron). The Commons may accept, amend or reject it when it considers Lords amendments.

**Not settled by the text.** Clause 66 is in Part 4, which commences on a day set by regulations (clause 69(3)), but its deadline runs from the day the Act is passed. The Bill does not say how these interact if the clause is not commenced promptly.

Related: [What Parliament has changed](https://cybersecurityandresiliencebill.com/guides/what-parliament-changed) · [AI and the Bill](https://cybersecurityandresiliencebill.com/guides/ai-and-the-bill)

### Clause 67: Register of foreign powers for the purposes of Part 4

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-4-national-security-directions#clause-67 · Affects: Government; indirectly OES and critical suppliers using vendors linked to listed states · Official text: HL Bill 62, PDF page 105 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=105)

**What the Bill says**

To inform action under Part 4, the Secretary of State must, by affirmative regulations made within six months of Royal Assent, establish and maintain a register of foreign powers believed to present a risk to the UK's critical network and information systems (clause 67(1) and (6)). It must include states GCHQ has confirmed attacked or attempted to attack OES or critical supplier systems in the UK in the preceding seven years through state bodies or affiliates, and states GCHQ has warned pose such a risk (clause 67(2)).

For each listed power the Secretary of State must review the risk, and within six months of the register being established lay a report with findings and a plan, or a statement if it cannot be laid for national security reasons (clause 67(3) to (5)). "Foreign power" includes heads of state, governments, their agencies and governing political parties (clause 67(7) and (8)).

**History.** Inserted at Lords Report stage on a non-Government amendment (amendment 164, Viscount Camrose, Lord Markham and Lord Alton of Liverpool). The Commons may accept, amend or reject it.

**Not settled by the text.** As with clause 66, clause 67 sits in Part 4, which is commenced by regulations, while its six-month deadline runs from Royal Assent.

Related: [Register of foreign powers](https://cybersecurityandresiliencebill.com/guides/register-of-foreign-powers)

## Related pages

- [National security directions](https://cybersecurityandresiliencebill.com/guides/national-security-directions)
- [Vendor direction powers](https://cybersecurityandresiliencebill.com/guides/vendor-direction-powers)
- [Register of foreign powers](https://cybersecurityandresiliencebill.com/guides/register-of-foreign-powers)
- [Glossary: national security direction](https://cybersecurityandresiliencebill.com/glossary/national-security-direction)
- [Fines and penalties](https://cybersecurityandresiliencebill.com/fines-and-penalties)
- [All 70 clauses](https://cybersecurityandresiliencebill.com/the-bill)