August 14, 2017

Organisations who fail to implement effective cyber security measures could be fined as much as £17 million or 4% of global turnover, as part of plans to make Britain’s essential networks and infrastructure safe, secure and resilient against the risk of future cyber attacks.

The plans are being considered as part of a consultation being undertaken by the Department for Digital, Culture, Media and Sport to decide how to implement the Network and Information Systems (NIS) Directive from May 2018 (see previous item).

The DCMS says that fines would be a last resort, and they will not apply to operators that have assessed the risks adequately, taken appropriate security measures, and engaged with competent authorities, but still suffered an attack.

The NIS Directive relates to loss of service rather than loss of data, which falls under the new General Data Protection Regulation (GDPR), which takes effect in May 2018. It will help make sure UK operators in electricity, transport, water, energy, transport, health and digital infrastructure are prepared to deal with the increasing numbers of cyber threats. It will also cover other threats affecting IT such as power failures, hardware failures and environmental hazards.

The Government says that the NIS Directive, once implemented, will form an important part of the Government’s five-year £1.9 billion National Cyber Security Strategy. It will compel essential service operators to make sure they are taking the necessary action to protect their IT systems.

The Government is proposing a number of security measures in line with existing cyber security standards. Operators will be required to:

• develop a strategy and policies to understand and manage their risk;
• implement security measures to prevent attacks or system failures, including measures to detect attacks, develop security monitoring, and to raise staff awareness and training;
• report incidents as soon as they happen; and
• have systems in place to ensure that they can recover quickly after any event, with the capability to respond and restore systems.

Any operator which takes cyber security seriously should already have such measures in place, the Government says.

The Government says that it is “fully committed to defending against cyber threats” and a five-year National Cyber Security Strategy (NCSS) was announced in November 2016, supported by £1.9 billion of transformational investment. The strategy includes opening the National Cyber Security Centre and offering free online advice as well as training schemes to help businesses protect themselves.

The consultation proposes similar penalties for flaws in network and information systems as those coming for data protection with the GDPR. Failure to implement effective security could see penalties as large £17 million or 4% of global turnover.

The Government says that it will shortly hold workshops with operators so they can provide feedback on the proposals. To read the DCMS press release in full, click here.