UK Announces Stricter Cyber Reporting Rules for Critical Infrastructure

The UK government has outlined new cybersecurity reporting requirements as part of its forthcoming Cyber Security and Resilience Bill, set to be introduced later this year.

The updated regulations will require organisations in critical sectors to report any cyber incidents that significantly impact system confidentiality, availability, or integrity. These include data breaches, spyware attacks, and major system compromises. Affected entities must notify their sector-specific regulator and the National Cyber Security Centre (NCSC) within 24 hours, with a full incident report due within 72 hours.

The bill also expands supply chain security requirements, ensuring Managed Service Providers (MSPs) and other key digital services adhere to stronger cybersecurity standards. Data centres will now be formally recognised as critical national infrastructure, granting them greater government support during cyber incidents.

To enforce compliance, regulators will receive greater enforcement powers. Additionally, the Secretary of State will gain authority to direct entities to take action on cyber threats when necessary for national security.

The legislation aims to align with EU standards (NIS2) while strengthening the UK’s cyber resilience against hostile states and cybercriminals. It will be introduced to Parliament later this year for debate and amendment.