Hospitals, energy and water supplies and transport networks are set to be protected from the threat of cyber-attacks under new laws being introduced in Parliament.

The Cyber Security and Resilience Bill strengthens national security and protects growth by boosting cyber protections for the services that people and businesses rely on every day.

These proposed laws would cover certain digital and essential services including healthcare, transport, energy and water.

Under the proposals:

• Medium and large companies providing services like IT management, IT help desk support and cyber security to private and public sector organisations like the NHS, will also be regulated for the first time. Because they hold trusted access across government, critical national infrastructure and business networks, they will need to meet clear security duties. This includes reporting significant or potentially significant cyber incidents promptly to government and their customers as well as having robust plans in place to deal with the consequences
• Regulators will be given new powers to designate critical suppliers to the UK’s essential services such as those providing healthcare diagnostics to the NHS or chemicals to a water firm, where they meet the criteria. This would mean they’d have to meet minimum security requirements – shutting down gaps in supply chains criminals could exploit which could cause wider disruption
• Enforcement will be modernised, including tougher turnover-based penalties for serious breaches so cutting corners is no longer cheaper than doing the right thing. That’s because companies providing taxpayer services should make sure they have tough protections in place to keep their systems up and running
• The Technology Secretary gets new powers to instruct regulators and the organisations they oversee, like NHS trusts and Thames Water, to take specific, proportionate steps to prevent cyber attacks where there is a threat to UK national security. This includes requiring that they beef up their monitoring or isolate high-risk systems to protect and secure essential services

These are areas which could pose huge negative implications for the British economy and public services if targeted. The Office for Budget Responsibility (OBR) estimates that a cyber-attack on critical national infrastructure could temporarily increase borrowing by over £30 billion – equivalent to 1.1% of GDP.

New independent research published today shows the average cost of a significant cyber-attack in the UK is now over £190,000. This amounts to around £14.7 billion a year across the economy – equivalent to 0.5% of the UK’s GDP.

Science, Innovation, and Technology Secretary Liz Kendall said:  “Cyber security is national security. This legislation will enable us to confront those who would disrupt our way of life. I’m sending them a clear message: the UK is no easy target.

“We all know the disruption daily cyber-attacks cause. Our new laws will make the UK more secure against those threats. It will mean fewer cancelled NHS appointments, less disruption to local services and businesses, and a faster national response when threats emerge.”

Earlier this year, the government published the Cyber Governance Code of Practice setting out what steps organisations should take to manage digital risks and safeguard their day-to-day operations.

While it is still down to the companies themselves to ensure they have proper protections in place, the Bill targets those that will have the maximum impact on improving cyber resilience, bringing the services that retailers, hospitals, councils and others depend on into scope – raising their baseline protects thousands of businesses in the long-term.

Recent cyber-attacks on managed service providers clearly make the case for updated laws. In 2024, hackers accessed the Ministry of Defence’s payroll system via a managed service provider, while other recent attacks such as the Synnovis incident in the NHS resulted in over 11,000 disrupted medical appointments and procedures and some estimates suggesting costs of £32.7 million.

Organisations in scope will need to report more harmful cyber incidents to their regulator and the National Cyber Security Centre (NCSC) within 24 hours, with a full report within 72 hours, to ensure support can be on hand more quickly to help build a stronger national picture of cyber threats.

Beyond this, if a data centre, or digital and managed service providers face a significant or potentially significant attack, they will have to notify customers which are likely to be impacted promptly so organisations can act fast to protect their business, people and services.

New safeguards will also cover organisations that manage the flow of electricity to smart appliances like electric vehicle charge points and electrical heating appliances in homes. This will reduce the risk of disruption to consumers using smart-energy appliances, and the grid, bolstering the UK’s energy security.

The Bill follows a recent letter from government ministers including the Technology Secretary, Chancellor and Business Secretary to business leaders and FTSE 350 firms, urging them to strengthen their cyber defences to face down the growing range of threats targeting the UK’s leading organisations.

Recommended reading

• NHS Scotland Invests £3M in AI Anti-ransomware Software
• UK Facing 4 Major Cyber-Attacks Each Week, Warns NCSC
• Winners Announced For The 2025 Scottish Cyber Awards

Organisations can make use of the free guidance and tools available from the NCSC – including Cyber Essentials, Active Cyber Defence services, and the Cyber Assessment Framework for the UK’s most critical organisations – to help improve their resilience.

Simon Sheeran, Head of Cyber Security Oversight at the UK Civil Aviation Authority said:  ”The aviation sector contributes billions of pounds to the UK economy and provides critical national infrastructure.

“This Bill will help improve cyber defences essential for maintaining the already very high safety standards in aviation.

“The Civil Aviation Authority protect people and enable aerospace within a global eco-system, and the need for aviation to defend as one is a national imperative.”