Dr Ben Spencer
MP for Runnymede and Weybridge · Conservative · United Kingdom
“On protection from flooding—I am glad that the Minister with responsibility flooding is on the Front Bench—there is no mention of the River Thames scheme in the Budget. The largest infrastructure scheme put forward by the Environment Agency is notably absent, which is deeply, deeply concerning. How about supporting children and families?”
House of Commons28 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Sadly, this Budget does not tackle the critical national issues that we face. It does not have a plan to reduce spending on welfare. It does not have a plan to increase spending on defence. It does not have definitive interventions to improve growth, tackle our spiralling debt or deal with the record high taxes all of us currently face.”
House of Commons28 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The fact that the Chancellor and the Prime Minister would rather have a non-Budget and call a general election than make the hard decisions today tells us everything we need to know about this Labour Government. There is another way with the Conservatives, and I am looking forward to it and so are my constituents.”
House of Commons28 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“We therefore welcome the narrow scope of the legislation and look forward to confirmation from the Minister regarding the preservation of the wider constitutional relationship between the Crown, the Government and the established Church.”
House of Commons21 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This has been one of the most interesting, wide-ranging and perhaps unexpected debates that I have had the pleasure to listen to in this House, with fascinating contributions from the hon. Members for North West Cambridgeshire (Sam Carling) and for Mid Derbyshire (Jonathan Davies), the Father of the House, my right hon.”
House of Commons21 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“To single out Roman Catholics and Jews and prevent them from carrying out the responsibilities of public office solely because of their faith is not a distinction that has any place in modern Britain.”
House of Commons21 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
The complete record
1,361 held · 571 searchable for Dr Ben Spencer. The searchable lines are below in date order, each linked to its source. Free to read, in full, without an account. Page 4 of 10.
This is not an official version of UK Parliament proceedings. It reproduces the published record and links to it; the official version is the one UK Parliament publishes.
“Dr Sanjana Mehta of ISC2 said in her oral evidence that the Department for Work and Pensions administered £288 billion of benefits over the past year, with more than 23 million people claiming benefits of some kind. That activity involves processing vast amounts of personal, medical and financial data, which presents rich pickings for malicious actors. The feedback from industry stakeholders, many of whom are being asked by the Government to take on onerous security and reporting obligations under this Bill, echoes those concerns regarding Government cyber-immaturity. There is a strong sentiment that the Government should be leading by example, as Chris Anley of the NCC Group commented in the Committee’s oral evidence sessions.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I beg to move, That the clause be read a Second time. The National Audit Office’s 2025 report on cyber-resilience highlighted that Government Departments and agencies are among the weakest links in the UK’s cyber-security ecosystem and lack a credible plan to become cyber-resilient in the short to medium term. The Government play a key role in the management of certain critical national industries, but the continuing cyber-security vulnerabilities in the IT systems used to operate CNI expose the UK to the threat of serious attacks that could undermine national security and the economy. That is not to mention the risk to enormous amounts of highly sensitive data held on Government systems.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I agree about the importance of putting things on the record. Since the hon. Member obviously has not been listening to my speech, he can check it out on the record. I acknowledged the challenges in this area— [ Interruption. ] Does the Government Whip want to intervene, or was she just chuntering? I will continue. Given that the Bill puts quite a burden on the private sector, as we discussed over several sittings before the parliamentary recess, I think it is important that the Government recognise, as my hon. Friend the Member for Spelthorne said, it would be pretty shameless not to vote for accountability for themselves while putting it on other people. Let us see how the vote goes. I commend new clause 5 to the Committee.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“In the evidence sessions, many of my questions to witnesses, including those from Ofgem, Ofcom and the Information Commissioner’s Office, focused on their preparations to meet the demands of their expanded roles. It was clear from feedback that although regulators understand what they need to do to prepare, the practical challenges associated with securing sufficient resource are far from resolved. I would therefore be grateful if the Minister could clarify his plans to review regulators’ progress and what the key milestones will be to ensure that regulators can discharge their new duties alongside their existing ones when these provisions come into effect.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“A review conducted by the Worshipful Company of Information Technologists identified a near total absence of formal financial sanctions under the NIS regulations, with zero confirmed major penalties from 2021 to 2024. The model has not been conducive to effective discharge of regulatory responsibilities, with knock-on effects for cyber-resilience and regulated industries, yet regulators will be expected to oversee a far larger pool of regulated bodies and process a far larger number of incident reports under the Bill’s provisions. It is therefore right for us to scrutinise carefully whether regulators are in a position to meet these obligations.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This new clause, tabled by the hon. Member for Brecon, Radnor and Cwm Tawe, would require the Secretary of State to consult and report within one year on whether regulatory authorities and regulated persons have sufficient resources and capabilities to meet their statutory obligations. Historical levels of regulatory oversight and enforcement in relation to the NIS regulations 2018 have fallen short of what is necessary to achieve meaningful cyber-resilience across regulated sectors. The second post-implementation review of the NIS regs 2018, conducted in 2022, found that incident reporting on the part of regulated entities was very low, with only 13, 12 and 22 NIS incidents reported in 2019, 2020 and 2021 respectively.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“18, Q20.] to help SMEs improve their cyber-resilience, and techUK has suggested that funding or relief could be applied on a priority basis, with those working within the critical national infrastructure supply chain looked at first. In the light of those considerations, what analysis has the Minister’s Department conducted of the likely return on investment, in terms of sustainability and growth among smaller companies, of a cyber support service for UK SMEs?”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Those schemes have enjoyed some success in hardening cyber-resilience among SMEs that have been able to access them. That can only be welcomed. There is a case for looking more closely at whether regulation is the appropriate first step to address the cyber-resilience of the smallest organisations that might be brought within the scope of regulation, as legal compliance efforts could detract from already pressured operational defence budgets. In giving evidence to the Committee, Jill Broom of techUK called for strategies “such as financial incentives, or…tax credits” –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“New clause 14, tabled by the hon. Member for Henley and Thame, addresses concerns regarding the capacity of SMEs to comply with their regulatory obligations, should they be brought within the scope of the Bill. That matter has been discussed on several occasions by the Committee. That is only right given that, according to figures provided by NCC Group, SMEs make up over 99% of businesses in the UK but too often lack the skills and budgets to implement proportionate cyber-protections, leaving them particularly exposed. SME cyber assistance schemes akin to the one proposed by the new clause have been rolled out in Scotland on a limited basis and in Australia, where the Government are investing 8 million Australian dollars over three years to provide free person-to-person support for small businesses during and after a cyber-attack.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“What assessment has the Minister made of the potential advantages and disadvantages of direct accountability in the adoption of effective cyber-resilience measures, based on a roll-out of the NIS2 regulations? Proportionate testing of systems may be a useful tool in detecting and managing cyber-security risk. What consideration has the Minister’s Department given to how that topic should be approached in the Secretary of State’s code of practice?”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“New clause 16 would require active board oversight of security and resilience measures and accountability for board members where they fail in those oversight duties, whereas new clause 17 would require regulated entities to carry out proportionate, periodic testing of the security and resilience of their network and information systems, and provide the results to regulatory bodies upon request. On board accountability, as we have already discussed in this Committee, the existing regulatory model under NIS regulations has not been sufficiently effective in driving up cyber-resilience standards to meet emerging threats. Board engagement is a key part of that, but the stat I quoted previously in this Committee indicates that engagement is going in the wrong direction.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Parliament is unlikely to legislate again in the cyber-security domain for some considerable time; we cannot afford to kick the can down the road on this vital issue any longer if we are to have a credible plan for whole-of-society cyber-resilience.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Member for Barnsley North (Dan Jarvis), highlighted the urgent need for changes to the law in this area in a recent speech, stating that Government have “heard the criticisms about the Computer Misuse Act, and how it can leave many cyber security experts feeling constrained in the activity that they can undertake.” He went on to say: “These researchers play an important role in increasing the resilience of UK systems, and securing them from…vulnerabilities. We shouldn’t be shutting these people out, we should be welcoming them and their work.” Yet the Home Office has brought forward no specific proposals for reform.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“That has created a chilling effect—talent is being lost, investment is stifled and security gaps are going unidentified. If we are to have true UK cyber-resilience—not just among regulated sectors, but across businesses of all types and throughout society—we need a multifaceted approach. Industry and private sector-led initiatives will play a strong role in that. Professor Child made clear that countries that have implemented more favourable regimes, such as the US and Israel, are benefiting from increased cyber-resilience as a result of cyber-research activity. The Government have acknowledged that reform of the CMA is a pressing issue. Indeed, the Home Office has been reviewing that question for some time. Further, the Minister for Security, the hon.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Professor Child made a clear and compelling case for the need to amend the Computer Misuse Act to provide statutory defences for legitimate cyber-research—sometimes called ethical hacking activities. Likewise, campaign groups, industry specialists and parliamentarians have all argued that the Computer Misuse Act, which was written before the modern internet, is no longer fit for purpose. At present, the Act fails to distinguish between malicious attackers and cyber professionals acting in the public interest, inadvertently criminalising a large proportion of research that UK cyber-security professionals can carry out to protect UK critical infrastructure and the UK’s technological ecosystem. This means that cyber-security professionals working to defend UK organisations from real-world threats risk prosecution.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The new clause would also require the Secretary of State’s review to evaluate whether the creation of such a defence would enable regulated bodies to improve the resilience of their network and information systems via enhanced vulnerability testing and research. New clause 18, tabled by the hon. Member for Henley and Thame, relates to the same important topic and would require the Secretary of State to review, and report to Parliament within 12 months of the Bill’s entering into law, whether amending the Computer Misuse Act could improve the resilience of network and information systems. Hon. Members will recall the insightful oral evidence of Professor John Child of the University of Birmingham.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I will speak to new clause 19, tabled in my name on behalf of His Majesty’s official Opposition. The new clause would compel the Secretary of State, within 12 months of Royal Assent, to review the need for a statutory defence, encompassing legitimate cyber-research activities, to criminal offences under clause 1 of the Computer Misuse Act 1990, which is about unauthorised access to computer programs. The campaign for reform in this area, CyberUp, has argued that, in its current form, the CMA inadvertently criminalises critical activity such as vulnerability research and threat intelligence, both of which are essential for defending the nation’s digital systems.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I thank the Chairs, the Clerks and all the teams working on the Bill—and Sophie Thorley from my office, who has done incredible research on the Bill.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I am a bit unclear about the hon. Gentleman’s intervention. The point I was making was that there is legitimate concern that people doing research into this area and doing threat assessments risk prosecution, so, across the whole of our society, that work is not being done. We have heard quite a lot of evidence from cyber campaigns about the benefits that changes to this law would make to the system, which is why we tabled the new clause. I commend new clause 19 to the Committee. I hope the Minister agrees that now is the time to address the issue. I suspect that this will be my last, or penultimate, time speaking to the Committee, so I would like to finish by thanking Members on both sides of the Committee for a fun and, at times, robust debate over the past month.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“We are a responsible Opposition and we are pleased to hear about the work that the Minister and his Department have been doing and about the shared purpose in getting this done and getting it right. Would he give us a bit more detail of the timescales and plans for public consultation? I understand that he has been doing some personal consultation in private, but will there be a public consultation? Given that the reform crosses two Departments, which Department will be taking it forward? What I am really looking for from him is a confirmation at the Dispatch Box that he is personally committed to getting this piece of work over the line during this parliamentary term.”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“On a point of order, Madam Deputy Speaker. This is a procedural question. Given that the long title of the Bill is not in the motion, does that mean that the Bill can effectively cover any subject or theme if the Order Paper is seized on that day?”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Further to that point of order, Madam Deputy Speaker. Thank you for that clarification, but my understanding is that that is the short title, not the long title. Is it the case that the long title can be used to tag in any related subjects to expand the scope from the narrow one here?”
House of Commons24 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“An additional concern that I have with the appointment of Peter Mandelson is that the American Government had compromising information in the form of the Epstein files. I wonder what consideration was given to the appointment of an ambassador who would be going into sensitive negotiations with a foreign Government knowing that that Government had compromising information. Will the Minister confirm that those considerations and that information is in scope of the disclosures?”
House of Commons23 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clearly, the system needs reform, but many families that have managed to get through the system and get an EHCP will be concerned by the announcements and the uncertainty today. I note that the Government anticipate that by the end of this decade there will be a reduction in children with the highest need. Does the Secretary of State believe that that will be due to a reduction in their need or in provision?”
House of Commons23 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“What about the cancelled mayoral elections, such as those in Sussex and Hampshire? Do not the same arguments that the Secretary of State has made apply to those elections, or is he just afraid of our candidates, Katy Bourne and Donna Jones?”
House of Commons23 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“They have also said that those thresholds will “clarify the points at which we would consider the impact of an incident to be ‘significant’, and therefore reportable to regulators”. What discussions has the Minister had to date with regulated entities and regulators about the approach to consultation on these thresholds? What is the feedback on what those organisations consider to be reporting priorities?”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This will lead to over-reporting of low-level incidents and potentially overwhelm regulators, thereby distracting attention from genuinely significant threats.” As in many aspects of the Bill, the problem is not on the principle but in the detail. We heard in oral evidence about the concerns of industry and regulators regarding the availability of suitably qualified personnel to build capacity for effective regulatory oversight. We must be alive to that important consideration in ensuring that thresholds are proportionate and risk-based. The Government have stated in their factsheets on the Bill that they intend “to introduce thresholds through secondary legislation before this measure is brought into in force” and after a period of consultation.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Those details are vital if reporting is to be successful in ensuring that regulators are kept appraised of the most serious threats. Dr Mehta summarised that concern succinctly in her comment: “In the absence of those thresholds, our concern is that regulated entities may be tempted to over-report rather than under-report, thereby creating more demand on the efforts of the regulators”. –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 16, Q14.] Likewise, techUK has stated in its written briefings on the Bill that “technically any phishing email is ‘capable of’ having a significant impact if the organisation lacks adequate detection or response capabilities.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Once systems are infiltrated, attackers remain in systems, sometimes harvesting data, waiting for the moment when they can cause maximum harm and disruption. Those serious risks should be flagged to regulators wherever they are identified. Dr Sanjana Mehta of ISC2 described problems of underreporting in relation to the existing NIS regulations regime, and welcomed the principle of expanding reporting, as did Jill Broom of techUK. However, both cautioned that while some high-level factors have been provided as to the criteria indicating whether an attack should be reported, such as the number of users, impact, duration of interruption and geographical reach, what is not clear at present are the thresholds that are linked to those criteria.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Government’s explanatory notes for the Bill state that this change in definition “is designed to include incidents that have compromised the integrity or security of a system without causing significant disruption yet, but that could have potential significant impacts in the future.” This has been broadly welcomed by industry stakeholders as a measure that should provide regulators with greater intelligence about emerging threats, leading to improved risk management and hardened resilience in their sectors. On the importance of intelligence gathering, we heard evidence from David Cook of DLA Piper and Chung Ching Kwong of the Inter-Parliamentary Alliance on China, among others, about the increasing use of prepositioning and “live off the land” technologies deployed by malicious actors.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“It is therefore a welcome development that clause 15 significantly increases the scope and speed of cyber-incident reporting by regulated entities to competent authorities and the NCSC. That increase in scope is achieved by broadening the definition of reportable incidents from the current position, where only cyber-attacks having an actual adverse effect are reportable, to a position to where cyber-incidents that are capable of having an adverse effect on the operation or security of network and information systems must also be reported.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“It is a pleasure to serve under your chairmanship, Dr Murrison, and it is always a pleasure to follow my hon. Friend the Member for Bognor Regis and Littlehampton. I will speak to clauses 15 and 16 and to new clauses 6 and 7, tabled in my name on behalf of His Majesty’s loyal Opposition. The previous Government stated in their consultation covering the subject of cyber-incident reporting that security breaches that did not result in a successful attack could still leave organisations open to follow-up attacks. It was identified that reporting how the breach took place would also allow regulators and other organisations to prepare for similar attacks in the future.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“New clause 7 reflects the concerns of regulated bodies and industry representatives who have set out many, many times—in oral evidence and beyond—the need to ensure that reporting obligations are clear and, as far as possible, simplified across the many different incident reporting regimes that exist for providers of digital services. The new clause would compel the Secretary of State to publish an assessment of the impact of the new reporting regime on regulated entities in the Bill within 12 months of Royal Assent. Importantly, in line with the clear requests articulated by many stakeholders who gave evidence last Tuesday, it requires the Government to publish proposals for the creation of a single cyber incident reporting channel for relevant bodies.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Since tabling it, we have heard impactful evidence from Carla Baker from Palo Alto, who highlighted the number of cyber incidents and false positives that many companies encounter each day. As I said in response to an intervention, in the absence of measures brought forward by the Government to address the widespread and urgent risks presented by ransomware attacks—and as the Government themselves identify as part of the Home Office’s review—it would be proportionate to make specific reference to ransomware in the reporting requirements on regulated entities in the Bill.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Opposition are trying to make it clear that ransomware needs to be in the scope of the reporting. It is really for the Minister to answer if he thinks there are problems with the new clause, and if so, how the Government will go about taking that forward. The widespread and highly damaging nature of ransomware attacks—which are often perpetrated by criminal groups at scale and speed—means that regulators need to have a detailed oversight of this area to prevent those attacks from being deployed more widely. Therefore, the new clause is intended to ensure that all ransomware attacks on regulated entities are reported, regardless of severity or potential severity, so that the risks are picked up. In tabling new clause 6, I am acutely aware of the existing reporting burden for regulated entities and regulators.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I thank the hon. Lady for her intervention. New clause 7 puts forward an assessment of the impact. It is not intended to make definitive changes, but to give time. I have confidence in the Government and the Minister that within 12 months—it is the kiss of death to say that one has confidence at the minute, is it not? [ Laughter. ] I apologise to the Minister.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“In view of that, will the Minister support this urgently needed review clause to assure industries that the Government have heard their serious and vital concerns on the matter?”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Industry stakeholders have expressed strong concerns regarding the diverse incident reporting requirements that exist in several pieces of legislation, including UK GDPR, sector-specific regulation and the Telecommunications (Security) Act 2021. As we have already discussed, the Home Office may also bring forward guidelines for reporting ransomware incidents in future. Additional reporting requirements and procedures included in the Bill are viewed as adding a further layer of complexity to a legislative environment that is already very challenging to navigate. Stakeholders report that the current approach, with multiple different reporting procedures and platforms, increases regulatory compliance costs on businesses and detracts from the resources available to implement effective improvements in cyber-resilience.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I very much take the hon. Lady’s point and the constructive spirit in which it was presented. Twelve months is a long time for the operations of Government to function, and I have faith—I will change my words—in the Government and all of their powers if they wanted to put their minds to bringing this forward. If there are concerns about the ability of the Department for Science, Innovation and Technology to take this forward, those concerns would spill over into all of the consultation requirements that have to be met to make sure that this Bill functions in the correct way. The argument on what we are debating today could swing both ways.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 17 will amend the NIS regulations to provide a framework for regulators to impose charges on regulated entities to recover the costs incurred by them in carrying out their supervision and enforcement functions. The Government’s explanatory factsheet supporting the Bill suggests that those changes are needed to ensure that regulators are “better resourced to carry out their responsibilities.” We have heard at length from witnesses in oral evidence sessions that resourcing is a key consideration for regulators in meeting their new and expanded obligations under the Bill. The concept of our regulators’ being better funded is good. However, as with much of the Bill, the lack of detail around the regulator charging model is causing uncertainty among regulated entities that would be liable to meet the associated costs.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“What guidance or consultation will the Minister produce to make sure that such powers are proportionate and not at risk of abuse?”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“What steps are the Government taking to ensure that regulators share responsibility for protecting sensitive data, and that information-sharing processes are coherent, proportionate and secure? Could the Minister elaborate on the discussions he has had with regulators on those matters, and on how secure information sharing will work in practice? Finally, on the detail of the text in Government amendment 14, proposed new paragraph (aa)(ii) refers to persons “otherwise in connection with…any other matter relating to cyber security and resilience,”. Given that this is an information-sharing power, that seems a remarkably broad “any other matter” provision. What disclosures that are not already covered in the Bill does the Minister conceive will come up in that scope?”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“In particular, the Bill creates a new gateway to ensure that NIS regulators can share information with UK public authorities, and vice versa, as well as sharing and receiving information from organisations outside of the NIS framework, for example other regulators or bodies such as Companies House. The Bill strengthens safeguards on how information can be used once it has been shared under the NIS regulations by restricting onward disclosure. More effective information sharing will be vital for competent authorities to keep up to date with emerging risks and building resilience in their sectors, and the new measures were broadly welcomed by regulators in our oral evidence session. However, industry bodies such as techUK have called for further detail on the new information-sharing regime.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 18, which the Government seek to modify through amendments 14 to 18, creates new pathways for information sharing between regulators, public authorities and Government Departments. It also creates a power for NIS enforcement authorities to share information with relevant overseas authorities for specified purposes. The new regime is intended to remove gaps and ambiguities in the existing framework governing the sharing of information obtained in the course of competent authorities and the oversight role of NCSC, and to create legal certainty in this domain. In turn, it is anticipated that greater information sharing will assist with the detection of crime, enforcement activity and awareness of emerging cyber-risks and with ascertaining the effectiveness of the NIS regulations in building UK cyber-resilience.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Can the Minister provide further details about whether consultation between regulators and the Secretary of State is under way on a consistent approach to regulation?”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 19 amends the NIS regulations and will require regulators to publish guidance on the security and instant reporting requirements of regulated sectors. In formulating their guidance, regulators are under a duty to co-ordinate and consult with other regulators to ensure consistency as far as is reasonably possible. Relevant provisions in the code of practice, to be issued by the Secretary of State under clause 36, must also be taken into account. Newly regulated entities will, no doubt, welcome proportionate guidance on meeting obligations, and existing regulated entities will appreciate any streamlining that comes from consultation between regulators and their approach.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I know I will be told off by the Chair if I try to rehash the previous debate on clause 12, but one of the points I made during that debate was that the scope of what could fall under the definition of a critical supplier could, in my view, include any supplier to an operator of an essential service. Potentially, therefore, a request for information under this provision could be incredibly broad. Can the Minister give some reassurance about how this will work in practice, relating to the proportionality of data collection? The concern is that this could become a fishing or dredging exercise, rather than something that is proportionate and targeted on the most high-risk suppliers.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 20 grants regulators wide-ranging information-gathering powers, in relation both to regulated entities and to organisations currently outside the scope of the regulations. These new powers will be important to competent authorities in gaining access to the information necessary to consider which businesses should be designated as critical suppliers for their sectors. The Minister will remember that we had a very extensive discussion about the allocation, or otherwise, of critical suppliers. What assurance can he give that requests for information under this new clause will be exercised proportionately? That is especially relevant for SMEs, which might struggle administratively to meet broad requests for information within short deadlines.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Will the Minister talk through what the data exchange flow chart will look like? How will it work in practice? Will the OES proactively contact the regulator and say, “We have all these suppliers—go play”? Will the regulator contact the OES and say, “Give us a list of all your suppliers, and then we are going to start an investigation programme and decide what data we need”? What is the direction of communication in practice? Or—perhaps even worse—will the burden be on suppliers to an OES to contact the regulator and say, “Could we possibly be in scope?” How will it shake out in practice?”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Minister has mentioned business continuity plans a second time as a justification for not going into detail on this, but the whole reason for the Government bringing in the powers in clause 12, and the designation of critical suppliers, is that there was no business continuity plan in place in the example of Synnovis. I do not see how that argument gets away from the need for clarity, for organisations that could be at risk of being in scope of being assessed and designated as a critical supplier, about what actions they have to take in response to regulation, proactively or otherwise, and the burdens on them. We have just discussed the cost of enforcement, which risks essentially becoming a cyber-security tax.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗