Title page 1

Contents 2

1. Cyber security and resilience 3

1.1. How are cyber attacks carried out? 3

1.2. Who carries out cyber attacks? 5

1.3. What are the impacts of cyber attacks? 6

1.4. How is the situation changing? 7

2. Network and Information Systems Regulations 2018 10

2.1. Scope and provisions of the 2018 NIS regulations 10

2.2. Post-implementation reviews of the 2018 NIS regulations 12

2.3. Previous proposals for reform 13

2.4. EU Network and Information Systems 2 Directive 15

3. What the bill would do 16

3.1. Structure of the bill (part 1) 16

3.2. Expanding the scope and effect of the 2018 NIS regulations (part 2) 17

3.2.1. Persons regulated under the NIS regulations (chapter 1) 17

3.2.2. Provision of information and reporting of incidents (chapter 2) 20

3.2.3. Other amendments to the 2018 NIS regulations (chapter 3) 21

3.3. Security and resilience of systems: Functions of the secretary of state (part 3) 22

3.3.1. Key definitions (chapter 1) 22

3.3.2. Statement of strategic priorities (chapter 2) 22

3.3.3. Regulations about security and resilience of systems (chapter 3) 23

3.3.4. Code of practice (chapter 4) 24

3.3.5. Report on network and information systems legislation (chapter 5) 25

3.3.6. Regulations under part 3 (chapter 6) 25

3.4. Directions for national security purposes (part 4) 26

3.5. General (part 5) 29

4. Reaction to the bill 29

5. Consideration of the bill in the House of Commons 32

5.1. Second reading 32

5.2. Committee stage in the House of Commons 35

5.2.1. Government amendments 35

5.2.2. Conservative Party amendments 36

5.2.3. Liberal Democrat amendments 38

5.2.4. Amendments to the Computer Misuse Act 1990 39

5.3. Report stage 40

5.4. Third reading 42