Catenaa, Friday, November 21, 2025- The UK government has formally introduced the Cyber Security and Resilience (CSR) bill to Parliament, reports said.
The bill aims to expand existing Network and Information Systems (NIS) regulations to cover a wider range of technology and managed service providers.
The legislation seeks to improve network and data security, enhance reporting and response to cyber incidents, and reduce risks to critical infrastructure and business networks.
Under the bill, IT management, tech support, and cybersecurity service providers would face the same obligations as companies already under NIS rules. Noncompliant firms could be subject to penalties based on turnover.
The legislation also gives the technology secretary powers to direct regulators and organisations to implement preventive measures against cyber threats that pose national security risks.
Independent research commissioned by the Department for Science, Innovation and Technology (DSIT) estimated the average cost of a serious cyber attack in the UK at £190,000 per incident, totaling roughly £14.7 billion annually, highlighting the economic impact of insufficient cyber defences.
Officials noted the legislation aligns UK law with EU standards and strengthens protections against state-sponsored attacks, implicitly addressing threats from nations including China, Iran, and North Korea.
The bill includes separate provisions to prevent AI misuse, specifically targeting the creation of child sexual abuse material. It would authorise trusted organisations, including AI developers and charities, to test AI models for vulnerabilities before harmful content is generated, aiming to embed safety at the source.
Science, Innovation and Technology Secretary Liz Kendall said the legislation reinforces the UK’s approach to cyber threats, aiming to safeguard public services, businesses, and citizens.
