The UK Government has shared full details of the Cyber Security and Resilience Bill for the first time, with plans aiming to bolster the UK’s online defences, protect public services, and safeguard growth.

The Bill, to be introduced to Parliament later this year, contains new measures that the government hopes can boost the protection of supply chains and critical national infrastructure, including IT service providers, hospitals and energy suppliers.

According to the government, 1,000 service providers will fall into the scope of the measures, with the hope that firms providing essential IT services to the public sector will no longer be an easy target for cybercriminals.

Stressing the need for better national cyber-defence, the government said that cyber threats cost the UK economy almost £22 billion a year between 2015 and 2019, and that figures show a hypothetical cyber-attack focused on energy services in the South East of England could wipe over £49 billion from the wider UK economy.  

“Attempts to disrupt our way of life and attack our digital economy are only gathering pace, and we will not stand by as these incidents hold our future prosperity hostage,” said secretary of state for technology, Peter Kyle.

“The Cyber Security and Resilience Bill, will help make the UK’s digital economy one of the most secure in the world – giving us the power to protect our services, our supply chains, and our citizens – the first and most important job of any government.”

At the same time, the government said it is also exploring additional measures to make sure it can respond effectively to new cyber threats and take rapid action when needed.

This includes giving the technology secretary powers to direct regulated organisations to shore up their cyber defences, and may include new protections for more than 200 data centres scattered across the country, which have already been designated as critical national infrastructure. 

To September last year, the National Cyber Security Centre (NCSC) claims it has managed 430 cyber incidents, with 89 of these being classed as nationally significant – a rate of almost two every week – with 50% of British businesses suffering a breach or cyber-attack in the last twelve months, and more than seven million incidents being reported in 2024.

Recommended reading

• AI in Cybersecurity: A Risk or an Opportunity?
• UK Public Wants More Regulation to Feel Okay About AI
• UK Gov Launches £5M Challenge Fund to Strengthen AI Security

“The Cyber Security and Resilience Bill is a landmark moment that will ensure we can improve the cyber defences of the critical services on which we rely every day, such as water, power and healthcare,” said NCSC CEO, Richard Horne.

“It is a pivotal step toward stronger, more dynamic regulation, one that not only keeps up with emerging threats but also makes it as challenging as possible for our adversaries.”

The legislative proposals follow other action designed to boost UK cybersecurity, including a new AI cybersecurity standard to protect AI systems, an international coalition to boost cyber skills, and the Cyber Local programme to support the UK’s £13.2 billion cybersecurity industry, which the government claims has created 6,600 new jobs in the past year.