Organisations who fail to implement effective cyber security measures could be fined as much as £17 million or 4 per cent of global turnover, as part of plans to make Britain’s essential networks and infrastructure safe, secure and resilient against the risk of future cyber attacks.

The plans are being considered as part of the consultation by the Department for Digital, Culture, Media and Sport to decide how to implement the Network and Information Systems (NIS) Directive from May 2018.

Fines would be a last resort and will not apply to operators that have assessed the risks adequately, taken appropriate security measures, and engaged with competent authorities but still suffered an attack.

The NIS Directive relates to loss of service rather than loss of data, which falls under the General Data Protection Regulations (GDPR).

It will help make sure UK operators in electricity, transport, water, energy, transport, health and digital infrastructure are prepared to deal with the increasing numbers of cyber threats. It will also cover other threats affecting IT such as power failures, hardware failures and environmental hazards. Businesses in these sectors identified by as “operators of essential services” will have to take appropriate and proportionate security measures to manage risks to their network and information systems.

Key digital service providers (search engines, cloud computing services and online marketplaces) will also have to comply with the security and incident notification requirements established under the Directive.

Introducing the consultation,  Matt Hancock MP Minister of State for Digital commented:

“Recent events such as the WannaCry ransomware attack, the 2016 attacks on US water utilities, and the 2015 attack on Ukraine’s electricity network clearly highlight the impact that can result from adversely affected network and information systems.

“There is a need to therefore improve the security of network and information systems across the UK, with a particular focus on essential services (energy, health, transport, water, and digital infrastructure) which if disrupted, could potentially cause significant damage to the UK economy, society and individuals’ welfare.”

Under the requirements of the Directive the UK must identify the “operators of essential services”  who must comply with the Directive. In the water sector, the Government is proposing that the national threshold for providers of drinking water supply and distribution and the supply of potable water to households should apply to operators with sites serving 350,000 or more people.

The proposed thresholds for a range of sectors are generally set at such a level as to capture only the most important operators, rather than the whole sector.

The NIS Directive, once implemented, will form an important part of the Government’s five-year £1.9 billion National Cyber Security Strategy. It will compel essential service operators to make sure they are taking the necessary action to protect their IT systems.

The Government is proposing a number of security measures in line with existing cyber security standards which operators will be required to put in place, including:

• to develop a strategy and policies to understand and manage their risk;
• to implement security measures to prevent attacks or system failures, including measures to detect attacks;
• to develop security monitoring;
• to raise staff awareness and training;
• to report incidents as soon as they happen;
• to have systems in place to ensure that they can recover quickly after any event, with the capability to respond and restore systems.

In the Government’s view any operator which takes cyber security seriously should already have such measures in place.

National Cyber Security Centre NCSC CEO Ciaran Martin said:

“We welcome this consultation and agree that many organisations need to do more to increase their cyber security.

“The NCSC is committed to making the UK the safest place in the world to live and do business online, but we can’t do this alone.

“Everyone has a part to play and that’s why since our launch we have been offering organisations expert advice on our website and the Government’s Cyber Essentials Scheme.”

The consultation proposes similar penalties for flaws in network and information systems as those coming for data protection with the General Data Protection Regulation, due to be in force by May 2018. Failure to implement effective security could see penalties as large £17 million or 4 per cent of global turnover.

The Government will shortly hold workshops with operators so they can provide feedback on the proposals.

Click here to download the consultation paper.

Waterbriefing is media partner with the 4th Annual Industrial Control Cybersecurity Europe Summit in London this September. 

Click here for more information