Ben Spencer MP: speeches

Speeches

• 16 Jun 2026 · Cyber Security and Resilience (Network and Information Systems) Bill · Hansard source

  More

  I thank the hon. Gentleman for the knowledge and experience he brings to the background of that particular case. I entirely agree that it is incumbent on all parties across the House to strengthen our national security and to be clear-eyed about the threat of hostile state actors. I will continue to develop that point in my wind-up speech. The evidence is clear that we face an increasing threat from foreign state actors. We need to take action to recognise those risks and to prevent such attacks. Cyber-security should be at the forefront of our defences, and for that reason, His Majesty’s loyal Opposition have focused again on amending the Bill, particularly with new clauses 14 and 15. We table them in the hope that the Government will not squander another opportunity to act in this Bill. New clause 14 would require the Government to directly identify the threats we face, ending the prevarication we have seen in recent months by obliging the Secretary of State to establish and maintain by regulation a list of foreign powers presenting a significant cyber-security risk to the UK. The amendment would strengthen the link between intelligence agencies and policy enforcement, ensuring that decisions by the Secretary of State to deploy special national security direction powers are based on GCHQ’s verified risk assessments regarding hostile states and state-affiliated groups. It is not about reacting after an attack occurs, but creating a proactive framework to evaluate and mitigate threats, built directly into UK supply chains. That would ensure that the UK is better prepared to deal with cyber-threats and attacks from hostile state actors. With the risks continuing to grow, these decisions cannot remain at the political whim of a Government who are reluctant to act. Let us talk about the dragon in the room. In 2024, the National Cyber Security Centre confirmed that China state-affiliated actors were responsible for cyber-attacks on the UK’s Electoral Commission and Parliament in 2021 and 2022, yet this Government continue to refuse to recognise China as a threat to the UK. New clause 14 would compel the Government to recognise formally what is readily apparent to those on these Benches, to our security services and to the many Members across both Houses who have expressed urgent concern about the security risks that China and other foreign state actors pose to the United Kingdom. The new clause would force the Government to acknowledge that China is a threat. In view of this established and growing threat, our new clause 15 would compel the Secretary of State to review state-sponsored cyber-threats to the UK’s infrastructure, including the cyber-security risk to surrounding critical networks in the vicinity of the super-embassy site in the City of London. As I said in Committee, there is simply no point in granting the Secretary of State powers to issue directions on the basis of national security if the Government are not willing to be clear-eyed about the most critical national and cyber-security threats to this nation. The new clause also strikes an important balance between ensuring parliamentary scrutiny and recognising and protecting the sensitive nature of some of the material that may be unearthed, by making provision for such information to be sent to the Intelligence and Security Committee of Parliament. I am pleased that, having resisted calls to address this risk during previous stages of the Bill’s progress, the Government have now taken some action to address risks from foreign state actors. The publication last week of their National Security (State Threats) Bill comes in response to a sharp spike in state-backed intelligence operations, sabotage and proxy violence. Their own explanatory notes to that Bill state: “Threats to the UK from foreign states are persistent and take many forms, including espionage, foreign interference in the UK’s political system, sabotage, disinformation, cyber operations, and even assassinations. Collectively these are referred to by the Government as state threats.” However, the Bill itself does not once mention cyber-security, and contains no provision requiring assessment of the risks posed. It does not apply to states themselves, and therefore can only be complemented and strengthened by new clauses 14 and 15, which no responsible Government or Member of the House could vote against. Amendment 3, which would insert a provision headed “Exemption from disclosure: right to a fair trial”, was tabled by my right hon. Friend the Member for Chingford and Woodford Green (Sir Iain Duncan Smith). As a Member of Parliament whose constituency includes Runnymede, I am proud both to call him a friend and to work with him on, in particular, his fight for the rule of law and fair trials. The amendment would prevent the sharing of information with overseas authorities for the purpose of prosecuting crimes not committed in the UK, if the Secretary of State determined that the receiving country was one in which the right to a fair trial could not be guaranteed. It would address genuine human rights concerns, and would close a loophole in the Bill that currently fails to anticipate politically motivated requests from authoritarian states. It would help to block hostile state actors such as Russia, China and Iran from probing our systems to detect firmware back doors or vulnerabilities within, for instance, the UK’s utility networks, healthcare systems and data centres. It would also create a statutory duty for the Secretary of State to submit an annual report to Parliament justifying decisions on which foreign jurisdictions are trusted or barred from intelligence sharing. That alone would be invaluable, and would end the many fruitless hours of questions and debate in the Chamber initiated by Conservative Members seeking a clear answer from the Government on whether they see countries such as China as a threat—per my earlier remarks. I am therefore pleased, on behalf of His Majesty’s Opposition, to support my right hon. Friend’s amendment. Let me also pay tribute to the Chair of the Science, Innovation and Technology Committee, the hon. Member for Newcastle upon Tyne Central and West (Dame Chi Onwurah). I thank her for her comments, which were echoed by others, about the risk from the internet of things and cellular modules. That is an important area, and we need to get it right. I will conclude by addressing the amendments tabled by our Liberal Democrat colleagues regarding digital sovereignty and the impact that this approach could have on the UK. New clause 13 is the clearest demonstration to date that the Liberal Democrats do not understand the tech sector or global supply chains. Of course it is right to support British business, but it is not feasible or possible to achieve full sovereignty in a global market or supply chain. Rather, we should prioritise capacities and capabilities, and ensure that the UK has an indispensable role in global supply chains.

• 14 May 2026 · Heathrow Airport: Third Runway · Hansard source

  More

  Notwithstanding my points about the third runway, the success of Heathrow is incredibly important to my constituents in providing jobs and economic activity locally. Will the Minister update us on the Government’s response to the concerns about kerosene supply, which impacts Heathrow and our economy?

• 13 May 2026 · Debate on the Address · Hansard source

  More

  I pay tribute to the opening speeches from the hon. Members for Bradford West (Naz Shah) and for Harlow (Chris Vince). However, context is key. The backdrop to the Gracious Speech is a Labour party engaged in open warfare—we heard something of that in earlier speeches—and a huge amount of uncertainty over what will happen in relation to the leadership of the Labour party and the current Prime Minister, and that uncertainty is playing out in the financial markets. The message that I want to convey to Labour Members is this: “Whatever you are going to do, please just do it quickly, because we need to move on.” The country needs leadership, and there are a great many important things that we need to be getting on with. As Labour Members are mulling over their options, I want to give the House some feedback from my constituency on a couple of issues affecting its residents. The message from the constituency is that small and medium enterprise is the backbone of our economy, but it is now under intolerable pressure. Let me give a couple of examples. I received a letter from One Cobham—a business improvement district covering Cobham, in my constituency—which was co-signed by 50 other BID members, that raised the issue of business rates in particular, but also rises in rent, wages and utility costs. Two companies have already gone bust recently, and this is putting intolerable pressure on the high street and individual businesses.

• 13 May 2026 · Debate on the Address · Hansard source

  More

  In a different world, we would have a very different King’s Speech. We would have the alternative Conservative King’s Speech from the Leader of the Opposition—soon, hopefully, to be the Prime Minister—which would scrap business rates for those with rateable values of up to, I think, £110,000. I ask Members please to look at the details. In recent weeks, I have visited another company, in Egham in the north of my constituency. It is a very specialist logistics company, which transports medical devices to be used in pathology investigations. In fact, it has probably supplied the pathology department at St Tommy’s across the river. The company has been operating for 40 years, but when I met its representatives, they told me that it faced going to the wall because of the increases in business rates and tax burdens. I hope to God that the company will be OK—that the Government will change course and that it continues to be successful—but if it does go to the wall, all the jobs and livelihoods of the people who work for it will go with it. That is a story that affects businesses and organisations across my constituency. In Chertsey, Addlestone, Weybridge, Woodham, Row Town, New Haw, Oxshott and Stoke D’Abernon—in all the different parts of my constituency —businesses are struggling, and free enterprise is under pressure. It is dying, and it is dying because of the tax and regulatory burdens that are being imposed on businesses by this Government. For all the great words in the King’s Speech, the fundamental problem is the Government’s tax and spend approach and the intolerable pressure that is being placed on free enterprise and business. This is my final message to Labour Members: “As you agonise over the direction of the Labour party leadership over the next few days, please just remember that you cannot tax a company that has gone bust.”

• 21 Apr 2026 · Middle East: Economic Update · Hansard source

  More

  The Chancellor will be aware of how important aviation is to the UK economy, particularly Heathrow, which is responsible for a huge amount of air freight and economic activity in my constituency. Given the reports regarding the supply chain for kerosene used in aviation, what measures is the Chancellor taking to ensure kerosene supply? What consideration has she given to tax relief to ensure that our aviation sector is sustainable and continues to contribute to the UK economy?

• 23 Mar 2026 · Financial Assistance to Industry · Hansard source

  More

  Will the Minister respond on the point about VAT on medicines and trials?

• 23 Mar 2026 · Financial Assistance to Industry · Hansard source

  More

  It is a pleasure to serve under your chairmanship, Sir Alec. His Majesty’s Opposition welcome this motion, which will allow the Secretary of State to make individual payments above £30 million to successful applicants to the life sciences large investment portfolio. The LSLIP has been developed and designed to support large-scale manufacturing and R&D investments in medicine, medtech and diagnostics, with a total budget of up to £570 million, and scope for individual awards of up to £130 million per project. It very much builds on the life sciences innovative manufacturing fund set up by the last Conservative Government to provide substantial capital grants for manufacturing innovation to strengthen the UK’s health supply chain. Together, the life sciences large investment portfolio and the life sciences innovative manufacturing fund provide a pipeline of support in the UK for both resilience-building manufacturing and global-scale industrial capability. The year 2025 was a challenging one for the UK life sciences sector, with AstraZeneca first scrapping plans to invest £450 million in expanding a vaccine manufacturing plant in Merseyside, blaming a reduction in Government support, and then announcing in September that it was pausing its £200 million research investment in Cambridge. That same month, Merck announced that it was scrapping a planned £1 billion expansion of its UK operations. However, that was not the full extent of the problems, with Eli Lilly and Sanofi also pausing investment in their UK operations. Several life sciences investments secured under the previous Conversative Administration were culled or put on hold after this Government took office. The life sciences large investment portfolio may go some way to recovering that lost ground and signalling to the life sciences sector that the UK remains serious about attracting, retaining and growing a world-leading life sciences R&D and manufacturing sector. Sadly, it will not be sufficient in isolation. The Government intervened late last year to stabilise the rebate rate applied to newer medicines under the voluntary scheme for branded medicines pricing, access and growth for 2026. However, UK rates remain significantly higher and more volatile than those in many of our peer countries, which is a deterrent to significant investment in UK life science industries. My first question therefore is, what further action are the Government taking to secure longer-term stability and predictability in this area? Last year, the Association of the British Pharmaceutical Industry made a pre-Budget submission calling on the Government to take action to restore the UK’s position as a global leader in life sciences. Among the ABPI’s recommendations was ensuring that VAT is not applied to free-of-charge medicines under early-access schemes, to preserve access for UK patients and maintain the UK’s attractiveness for clinical trials. However, The Sunday Times reported yesterday that one multinational drug company has stopped patients receiving early-access medicines, with another considering similar action after His Majesty’s Revenue and Customs issued VAT bills to pharma companies providing medicines under the scheme. That fiscal folly has real-world effects on not only the economy, but the lives of patients with debilitating and life-threatening conditions who are taking part in those trials. Therefore, my second question to the Minister is, what discussions has he had with Treasury colleagues about the urgent need to reform the tax system to make the UK a more attractive and stable jurisdiction for investment in life sciences?

• 18 Mar 2026 · Student Loans · Hansard source

  More

  I think that my right hon. Friend the Member for East Hampshire (Damian Hinds), sitting behind me, will give a more extensive answer to that question in a moment. There are lots of ways to measure degrees. An example that I often give is the degree in David Beckham studies, which I think existed. I am a big fan of David Beckham, by the way, but I am not sure how many degrees in David Beckham studies we need, or how it would benefit the economy or the individual. Critically, I am not sure that taxpayers should be subsidising that. All our constituents are contributing to this system, and it is only fair that we ensure that there is value for money for taxpayers, as well as for the people taking the courses, and that there is a broader contribution. It is absolutely right that, as part of this motion, we look at fairness in the system, particularly to make sure that degrees, which are regulated, give the value that they are purported to give, and that we do not have fake degrees or degrees with a disproportionate difference between the offering—what people think they are going to get—and the outcomes. When people are starting on a degree course, it is important for them to know where they can expect to be in five or 10 years’ time and what their status in society will be, so that they can make informed choices given the substantial cost, in terms of both time and money, of their investment. On that basis, I wholeheartedly support the motion and look forward to voting for it later tonight. I hope Labour Members do so as well, because this motion brings back a bit more hope and a bit more fairness to the system.

• 18 Mar 2026 · Student Loans · Hansard source

  More

  I am going to talk about hope and fairness, to which many Members across the House have referred in their speeches. It is important that everyone has hope for the future, but particularly the next generation. There are many challenges facing younger people at the moment, from youth unemployment, with the graduate jobs market unfortunately in decline, to the uncertain world we live in. The people who will inherit this world from us are concerned about conflict in the middle east, the position of our defence, and the direction in which our country and society are going. It is younger people who have borne the brunt of the decisions made during covid, and it is younger people who will have to deal with and find solutions for the changing demographics in our society, particularly the ageing population. It is important now more than ever that the next generation—the younger generation—has hope for the future, and we Conservatives have a plan to bring that back. The key to that plan is fairness. Our motion today goes to the heart of fairness. It is fair to say that the repayment system for the people paying back plan 2 loans, with the thresholds and the interest at 3% above RPI, has essentially turned into some form of Ponzi scheme. The Conservatives have a plan to start resolving that. As has been said, it would not be possible to get these loans on a commercial basis; they are fundamentally unfair, and we have a plan to go about fixing it. When we talk about education more generally, we talk about the fact that all different types of education have intrinsic value. There is no hierarchy between people who go to university or further education, people who do apprenticeships and people who go straight into work. It is about providing the right education for the individual person. Whether someone has gone to university or done an apprenticeship—whatever route they have gone down—it does not make them a better or worse person. The key is that it is the right plan for them. It is only fair that we reverse some of the historic biases against apprenticeships in particular, and that is why I am so pleased that apprenticeships and vocational training are central to the motion that we will be voting on later. Fairness means fairness both to the taxpayer and to the people taking the courses. I intervened on both the Minister and the Liberal Democrat spokesperson, the hon. Member for St Neots and Mid Cambridgeshire (Ian Sollom), to ask whether they would at least concede that there are some courses—particular courses at institutions across the country—that are really not worth it because they are not value for money and will not help the student.

• 5 Mar 2026 · Business of the House · Hansard source

  More

  Can we have a debate in Government time on defensive military operations in the middle east?

• 4 Mar 2026 · Draft Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 · Hansard source

  More

  It is a pleasure to serve under your chairmanship, Ms Lewell. The statutory instrument makes consequential amendments to references in primary and secondary legislation to reflect the abolition of the Information Commissioner’s Office and the transfer of its functions to a new body corporate, the Information Commission. The Information Commission was granted additional powers and duties under the Data (Use and Access) Act, reflecting the increasing breadth of issues that impact data protection regulation, including the power to commission a new strategic framework and implementation plan. Obligations under the new framework set out a requirement for the Information Commission to take into account specified considerations when undertaking its duties, including the promotion of innovation and competition and the fact that children merit specific protection. On the important question of protections for children, the Minister will be aware that His Majesty’s official Opposition, in my name, tabled a new clause to the Data (Use and Access) Bill on this very issue. It sought to compel the Secretary of State to undertake a review within 12 months of Royal Assent, which was received in June 2025, of the case for raising the age of consent for social media to 16 under GDPR. The new clause received broad cross-party support but was voted down by the Government. Having finally responded, albeit too little and too late, to His Majesty’s Opposition and widespread public pressure to act, the Government launched their consultation on social media access for under-16s earlier this week. Does the Minister agree that had the Government accepted our amendment, their review would now be well under way, and we would be several steps closer to a solution for this generationally important challenge. I hope that in future they will consider a bit further the question of accepting Opposition amendments. In an increasingly digitised world, our industry regulators, including the Information Commission, face an ever-growing workload in circumstances where resources are under pressure. What discussion is the Minister’s Department having with the Information Commission about its ongoing strategy to ensure that it can meet its expanded role effectively?

• 4 Mar 2026 · Family Farms · Hansard source

  More

  International conflict and instability risk putting up food and fuel prices, and threaten our domestic food resilience. Instead of reviews and platitudes, we need action to protect our farmers and our UK food resilience. Will the Minister take action and scrap the damaging family farm tax?

• 3 Mar 2026 · Spring Forecast · Hansard source

  More

  Given what is happening in the middle east at the moment, there is a concern that petrol and diesel prices will spiral upwards. If that happens, taxation revenue on fuel will do the same. Can the Chancellor commit today to keeping taxation revenue at its current level, thereby reducing tax on fuel to help ease any future cost pressure?

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  New clause 14, tabled by the hon. Member for Henley and Thame, addresses concerns regarding the capacity of SMEs to comply with their regulatory obligations, should they be brought within the scope of the Bill. That matter has been discussed on several occasions by the Committee. That is only right given that, according to figures provided by NCC Group, SMEs make up over 99% of businesses in the UK but too often lack the skills and budgets to implement proportionate cyber-protections, leaving them particularly exposed. SME cyber assistance schemes akin to the one proposed by the new clause have been rolled out in Scotland on a limited basis and in Australia, where the Government are investing 8 million Australian dollars over three years to provide free person-to-person support for small businesses during and after a cyber-attack. Those schemes have enjoyed some success in hardening cyber-resilience among SMEs that have been able to access them. That can only be welcomed. There is a case for looking more closely at whether regulation is the appropriate first step to address the cyber-resilience of the smallest organisations that might be brought within the scope of regulation, as legal compliance efforts could detract from already pressured operational defence budgets. In giving evidence to the Committee, Jill Broom of techUK called for strategies “such as financial incentives, or…tax credits” –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 18, Q20.] to help SMEs improve their cyber-resilience, and techUK has suggested that funding or relief could be applied on a priority basis, with those working within the critical national infrastructure supply chain looked at first. In the light of those considerations, what analysis has the Minister’s Department conducted of the likely return on investment, in terms of sustainability and growth among smaller companies, of a cyber support service for UK SMEs?

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I beg to move, That the clause be read a Second time. This new clause would require the Secretary of State to review the effect of existing information sharing and analysis centres, with a view to determining whether further such centres should be established. The financial services industry has successful voluntary schemes—the Cyber Defence Alliance, and the Financial Services Information Sharing and Analysis Centre—which act as hubs for collaboration on all matters relating to the prevention, detection, mitigation and investigation of cyber-threats and criminality impacting members. These organisations provide an essential alerting and co-ordinating role for their members, including providing intelligence and technical support during ongoing incidents. They can assist in building partnerships contextualised to particular sector risks. According to Richard Starnes of the Worshipful Company of Information Technologists, companies “may be competing with one another in their chosen businesses, but they are all in the same boat with regard to being attacked by whatever entities are attacking them.” And he said that if the FS-ISAC were replicated “on an industry-by-industry basis, particularly ones in CNI, that would be helpful. It would also help with information sharing with entities like NCSC and GCHQ.” –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 64, Q75-76.]

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I beg to move, That the clause be read a Second time. The National Audit Office’s 2025 report on cyber-resilience highlighted that Government Departments and agencies are among the weakest links in the UK’s cyber-security ecosystem and lack a credible plan to become cyber-resilient in the short to medium term. The Government play a key role in the management of certain critical national industries, but the continuing cyber-security vulnerabilities in the IT systems used to operate CNI expose the UK to the threat of serious attacks that could undermine national security and the economy. That is not to mention the risk to enormous amounts of highly sensitive data held on Government systems. Dr Sanjana Mehta of ISC2 said in her oral evidence that the Department for Work and Pensions administered £288 billion of benefits over the past year, with more than 23 million people claiming benefits of some kind. That activity involves processing vast amounts of personal, medical and financial data, which presents rich pickings for malicious actors. The feedback from industry stakeholders, many of whom are being asked by the Government to take on onerous security and reporting obligations under this Bill, echoes those concerns regarding Government cyber-immaturity. There is a strong sentiment that the Government should be leading by example, as Chris Anley of the NCC Group commented in the Committee’s oral evidence sessions. In view of the growing risk posed to UK cyber-security by hostile state actors, by their affiliates and by criminal gangs, improving Government cyber-security is urgent. It is clear from the NAO’s findings and other recent reports that Government Departments have lacked the clear goals and necessary accountability to incentivise tackling this significant challenge. In his letter of 19 February to members of the Committee, the Minister said: “Government will be held to equivalent cyber security requirements that we expect of the essential and digital services in scope of the Cyber Security and Resilience (Network and Information Systems) Bill.” But as matters stand, there are no effective legal mechanisms for accountability to Parliament on increasing Government cyber-resilience to the standards necessary to meet the intensifying threats facing our Government Departments and agencies. New clause 5 would compel the Secretary of State to make yearly reports to Parliament setting out the Government’s progress towards meeting the recommendations of the National Audit Office’s 2025 report on Government cyber-resilience and towards meeting the standards they set themselves in their recent cyber action plan. Where necessary, the Secretary of State would have to account for failures to meet deadlines for implementation and issue a new plan to achieve compliance. In moving this new clause, I am aware of the challenges that successive Governments have faced in driving up cyber-resilience standards. There are serious practical and budgetary obstacles that can impede progress, such as the vast amount of legacy IT equipment that remains in use, which is inherently more vulnerable to attack. Moreover, there is the ongoing problem of recruiting highly skilled cyber-security professionals to work in these roles, given the competition in the recruitment market and constraints on public sector salaries. Illustrative of that challenge is the worrying statistic, cited by Chris Anley of the NCC Group, that “almost a third of cyber-security posts in Government are presently unfilled”. –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 24, Q29.] None the less, the Government have now put in place a plan that they consider achievable, and they should be held to account for it. The new clause creates a mechanism for that much-needed accountability.

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I thank my hon. Friend for his intervention, which is more for the Minister and the Government Whip’s benefit than mine. Properly established ISACs will not only increase real-time awareness of cyber-risks and mitigations, but could also alleviate some of the burden on regulators in terms of sector-specific intelligence analysis. Industry feedback and experience from the adoption of the Network and Information Systems Regulations 2018 indicate that sectoral regulators are unlikely to have the capacity to assist with intelligence sharing in relation to real-time cyber-risks. We know from the sectoral regulators’ oral evidence that building sufficient capacity for effective regulatory oversight is a challenge. Where we have models for sector-led and market-led good practice in hardening cyber-resilience, we should look at how it can be rolled out further. Seeing more of these organisations emerge could even lead to broader adoption beyond NIS-regulated areas to other industries. ISACs have the potential to become integral nodes in improving whole-of-society cyber-resilience, and it is an approach called for by many cyber industry stakeholders. I therefore commend new clause 4.

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  Clause 18, which the Government seek to modify through amendments 14 to 18, creates new pathways for information sharing between regulators, public authorities and Government Departments. It also creates a power for NIS enforcement authorities to share information with relevant overseas authorities for specified purposes. The new regime is intended to remove gaps and ambiguities in the existing framework governing the sharing of information obtained in the course of competent authorities and the oversight role of NCSC, and to create legal certainty in this domain. In turn, it is anticipated that greater information sharing will assist with the detection of crime, enforcement activity and awareness of emerging cyber-risks and with ascertaining the effectiveness of the NIS regulations in building UK cyber-resilience. In particular, the Bill creates a new gateway to ensure that NIS regulators can share information with UK public authorities, and vice versa, as well as sharing and receiving information from organisations outside of the NIS framework, for example other regulators or bodies such as Companies House. The Bill strengthens safeguards on how information can be used once it has been shared under the NIS regulations by restricting onward disclosure. More effective information sharing will be vital for competent authorities to keep up to date with emerging risks and building resilience in their sectors, and the new measures were broadly welcomed by regulators in our oral evidence session. However, industry bodies such as techUK have called for further detail on the new information-sharing regime. What steps are the Government taking to ensure that regulators share responsibility for protecting sensitive data, and that information-sharing processes are coherent, proportionate and secure? Could the Minister elaborate on the discussions he has had with regulators on those matters, and on how secure information sharing will work in practice? Finally, on the detail of the text in Government amendment 14, proposed new paragraph (aa)(ii) refers to persons “otherwise in connection with…any other matter relating to cyber security and resilience,”. Given that this is an information-sharing power, that seems a remarkably broad “any other matter” provision. What disclosures that are not already covered in the Bill does the Minister conceive will come up in that scope? What guidance or consultation will the Minister produce to make sure that such powers are proportionate and not at risk of abuse?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  The Minister has mentioned business continuity plans a second time as a justification for not going into detail on this, but the whole reason for the Government bringing in the powers in clause 12, and the designation of critical suppliers, is that there was no business continuity plan in place in the example of Synnovis. I do not see how that argument gets away from the need for clarity, for organisations that could be at risk of being in scope of being assessed and designated as a critical supplier, about what actions they have to take in response to regulation, proactively or otherwise, and the burdens on them. We have just discussed the cost of enforcement, which risks essentially becoming a cyber-security tax.

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  Part 3 is a very important part of the Bill. It gives the Secretary of State a range of powers, including ones to bring additional sectors into the scope of regulation, to update the NIS regulations, to publish statements of strategic priorities for regulators and to publish codes of practice that set out cyber-security measures for entities to comply with their regulatory duties. Clause 24 includes a power enabling the Secretary of State to specify new services that can be brought into the scope of the NIS regulations, and to designate additional regulatory authorities. Those powers are intended to allow the Secretary of State to identify additional critical sectors and respond to emerging threats quickly. That agility introduced by this measure has been broadly welcomed as appropriate, given the fast-evolving nature of malicious cyber-activity. Given the extent of the Secretary of State’s new powers, however, it is important to put in place guardrails to ensure that the appropriate response to emerging threats is indeed further regulation, rather than market-led or insurance-based mitigations. Can the Minister provide any further information at this stage about the procedure that will be followed in deciding whether to expand the scope of regulation to ensure consistency and transparency? Hon. Members have tabled several new clauses that would prompt the Secretary of State to use her duties under clause 24. I will speak to new clause 1, tabled by the hon. Member for Warwick and Leamington (Matt Western), and new clause 9, tabled by the hon. Member for Brecon, Radnor and Cwm Tawe, together, as they have some thematic overlap. New clause 1 seeks to bring all entities, other than small businesses and microbusinesses, in the food production, distribution and retail supply chain into the scope of regulation as operators of essential services. New clause 9 also touches on the regulation of food supply chains. It would require the Secretary of State to designate retailers of “food and essential goods (when part of a large-scale distribution chain)” and manufacturers of “critical transport equipment” as providers of essential services to be brought into the scope of regulation. Those new clauses reflect concerns about the cyber-attacks targeting the food retailers M&S and Co-op last year. New clause 9 reflects issues raised by the major attack on JLR, which cause such disruption and threatened the stability of regional jobs and supply chains. Those attacks caused significant public concern, but they would all remain out of scope after the Bill comes into effect.

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  I think I will follow up in writing on my intervention to try to dig down into the explanation of how liability will be laid down when the client is not a regulated entity but is receiving services from regulated entities. That is an important point, because these are quite hefty fines. As my hon. Friend the Member for Spelthorne pointed out, even with £34 an hour lawyers, there will be a lot of industry activity to try to avoid liability in the context of a substantial cyber breach, which can be significant. More generally, the clause makes significant changes to enforcement practices under the NIS regulations, including to increase the financial penalties regulators can impose for infringement of the regulations, and to set out a clearer system of tiered penalties, based on the severity of infringements. The Government’s impact assessment states that these changes have been made because of concerns reported by regulators that “enforcement under the NIS Regulations has been constrained by unclear band structures and a maximum penalty which is insufficient to deter non-compliance across all NIS sectors”, which goes back to my previous point. Enforcement activity under the NIS regulations has been sparse, inconsistent and insufficiently effective to increase cyber-resilience to the levels necessary to meet the proliferating cyber-security risks to our most critical sectors. Fundamentally, the existing approach to enforcement has not achieved the necessary change in attitude to cyber-risk at the highest levels of regulated entities. It is concerning that board level responsibility for cyber-security has steadily declined among businesses since 2021, with 38% of businesses having a board member responsible for cyber-security in 2021, compared with 27% in 2025. The enforcement model clearly needs to be more effective, and increasing fines is only one part of that. Regulatory capacity to undertake supervision and enforcement remains a concern, as does perceived reticence on the part of regulators to impose fines on critical infrastructure providers, due to the risk of destabilising essential services and increasing costs for consumers. In our oral evidence sessions, many witnesses, including Richard Starnes of the Worshipful Company of Information Technologists, raised the issue of greater responsibility at the highest levels of management for cyber-resilience. What assessment has the Secretary of State undertaken of whether changes to the penalty regime are likely to influence board-level attitudes towards cyber-security?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  It is a pleasure to serve under your chairmanship, Dr Murrison, and it is always a pleasure to follow my hon. Friend the Member for Bognor Regis and Littlehampton. I will speak to clauses 15 and 16 and to new clauses 6 and 7, tabled in my name on behalf of His Majesty’s loyal Opposition. The previous Government stated in their consultation covering the subject of cyber-incident reporting that security breaches that did not result in a successful attack could still leave organisations open to follow-up attacks. It was identified that reporting how the breach took place would also allow regulators and other organisations to prepare for similar attacks in the future. It is therefore a welcome development that clause 15 significantly increases the scope and speed of cyber-incident reporting by regulated entities to competent authorities and the NCSC. That increase in scope is achieved by broadening the definition of reportable incidents from the current position, where only cyber-attacks having an actual adverse effect are reportable, to a position to where cyber-incidents that are capable of having an adverse effect on the operation or security of network and information systems must also be reported. The Government’s explanatory notes for the Bill state that this change in definition “is designed to include incidents that have compromised the integrity or security of a system without causing significant disruption yet, but that could have potential significant impacts in the future.” This has been broadly welcomed by industry stakeholders as a measure that should provide regulators with greater intelligence about emerging threats, leading to improved risk management and hardened resilience in their sectors. On the importance of intelligence gathering, we heard evidence from David Cook of DLA Piper and Chung Ching Kwong of the Inter-Parliamentary Alliance on China, among others, about the increasing use of prepositioning and “live off the land” technologies deployed by malicious actors. Once systems are infiltrated, attackers remain in systems, sometimes harvesting data, waiting for the moment when they can cause maximum harm and disruption. Those serious risks should be flagged to regulators wherever they are identified. Dr Sanjana Mehta of ISC2 described problems of underreporting in relation to the existing NIS regulations regime, and welcomed the principle of expanding reporting, as did Jill Broom of techUK. However, both cautioned that while some high-level factors have been provided as to the criteria indicating whether an attack should be reported, such as the number of users, impact, duration of interruption and geographical reach, what is not clear at present are the thresholds that are linked to those criteria. Those details are vital if reporting is to be successful in ensuring that regulators are kept appraised of the most serious threats. Dr Mehta summarised that concern succinctly in her comment: “In the absence of those thresholds, our concern is that regulated entities may be tempted to over-report rather than under-report, thereby creating more demand on the efforts of the regulators”. –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 16, Q14.] Likewise, techUK has stated in its written briefings on the Bill that “technically any phishing email is ‘capable of’ having a significant impact if the organisation lacks adequate detection or response capabilities. This will lead to over-reporting of low-level incidents and potentially overwhelm regulators, thereby distracting attention from genuinely significant threats.” As in many aspects of the Bill, the problem is not on the principle but in the detail. We heard in oral evidence about the concerns of industry and regulators regarding the availability of suitably qualified personnel to build capacity for effective regulatory oversight. We must be alive to that important consideration in ensuring that thresholds are proportionate and risk-based. The Government have stated in their factsheets on the Bill that they intend “to introduce thresholds through secondary legislation before this measure is brought into in force” and after a period of consultation. They have also said that those thresholds will “clarify the points at which we would consider the impact of an incident to be ‘significant’, and therefore reportable to regulators”. What discussions has the Minister had to date with regulated entities and regulators about the approach to consultation on these thresholds? What is the feedback on what those organisations consider to be reporting priorities?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  The Opposition are trying to make it clear that ransomware needs to be in the scope of the reporting. It is really for the Minister to answer if he thinks there are problems with the new clause, and if so, how the Government will go about taking that forward. The widespread and highly damaging nature of ransomware attacks—which are often perpetrated by criminal groups at scale and speed—means that regulators need to have a detailed oversight of this area to prevent those attacks from being deployed more widely. Therefore, the new clause is intended to ensure that all ransomware attacks on regulated entities are reported, regardless of severity or potential severity, so that the risks are picked up. In tabling new clause 6, I am acutely aware of the existing reporting burden for regulated entities and regulators. Since tabling it, we have heard impactful evidence from Carla Baker from Palo Alto, who highlighted the number of cyber incidents and false positives that many companies encounter each day. As I said in response to an intervention, in the absence of measures brought forward by the Government to address the widespread and urgent risks presented by ransomware attacks—and as the Government themselves identify as part of the Home Office’s review—it would be proportionate to make specific reference to ransomware in the reporting requirements on regulated entities in the Bill. New clause 7 reflects the concerns of regulated bodies and industry representatives who have set out many, many times—in oral evidence and beyond—the need to ensure that reporting obligations are clear and, as far as possible, simplified across the many different incident reporting regimes that exist for providers of digital services. The new clause would compel the Secretary of State to publish an assessment of the impact of the new reporting regime on regulated entities in the Bill within 12 months of Royal Assent. Importantly, in line with the clear requests articulated by many stakeholders who gave evidence last Tuesday, it requires the Government to publish proposals for the creation of a single cyber incident reporting channel for relevant bodies.

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  I very much take the hon. Lady’s point and the constructive spirit in which it was presented. Twelve months is a long time for the operations of Government to function, and I have faith—I will change my words—in the Government and all of their powers if they wanted to put their minds to bringing this forward. If there are concerns about the ability of the Department for Science, Innovation and Technology to take this forward, those concerns would spill over into all of the consultation requirements that have to be met to make sure that this Bill functions in the correct way. The argument on what we are debating today could swing both ways. Industry stakeholders have expressed strong concerns regarding the diverse incident reporting requirements that exist in several pieces of legislation, including UK GDPR, sector-specific regulation and the Telecommunications (Security) Act 2021. As we have already discussed, the Home Office may also bring forward guidelines for reporting ransomware incidents in future. Additional reporting requirements and procedures included in the Bill are viewed as adding a further layer of complexity to a legislative environment that is already very challenging to navigate. Stakeholders report that the current approach, with multiple different reporting procedures and platforms, increases regulatory compliance costs on businesses and detracts from the resources available to implement effective improvements in cyber-resilience. In view of that, will the Minister support this urgently needed review clause to assure industries that the Government have heard their serious and vital concerns on the matter?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  Clause 36 provides that the Secretary of State may issue a code of practice for regulated entities to set out measures that they should take to demonstrate compliance with their duties under the NIS regulations, or any requirements imposed by the Secretary of State under clause 29. If done well, the code could be a repository of best practice, setting proportionate, consistent and effective standards for regulated industries. That will require constructive and open consultation with regulated sectors to identify the challenges facing those sectors and how best to address them. One issue that came up in oral evidence was the question of the lag between regulation making and industry adoption. David Cook of DLA Piper commented that, after laws come into effect, the process of businesses understanding where they need to get to “often requires a multi-year programme of reform.” ––[ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee , 3 February 2026; c. 5, Q1.] The code of practice is not envisaged to be legally binding, in the sense that a failure to comply is not of itself evidence of a failure to meet obligations under the NIS regulations or the Bill. However, clause 38 states that it would be admissible as evidence in legal proceedings so, in that sense, the code is binding in all but name. In view of that, and the fact that codes can be revoked and reissued, can the Minister provide reassurance to regulated industries that a lead-in time will be built into any requirements to allow businesses to prepare to achieve full compliance?