Debate contribution: Cyber Security and Resilience (Network and Information Systems) Bill: Legislative Consent Motion

Debate contribution by Mr John O'Dowd on 19 October 2026.

MLA: Mr John O'Dowd
Party at the time: Sinn Féin
Date: 19 October 2026
Type: Debate contribution (made as a minister)
Business: Executive Committee Business
Heading: Cyber Security and Resilience (Network and Information Systems) Bill: Legislative Consent Motion
Assembly identifier: Official Report component 5795426

Text

I beg to move
Members will be aware of the growing cybersecurity risk that accompanies an increasingly digital and interconnected world. Technological change brings significant opportunities but also creates new and evolving risks. It is those risks that the Bill engages. Cybersecurity is critical to the continued delivery of the essential services that people, businesses and communities rely on every day. Those services increasingly depend on complex networks and digital systems, and ensuring their security and resilience has never been more important. Cyberthreats to such services continue to evolve. It is therefore essential that the regulatory framework evolves with them.
The Cyber Security and Resilience (Network and Information Systems) Bill was introduced in Parliament on 12 November 2025. Its purpose is to update and strengthen the existing Network and Information Systems (NIS) Regulations 2018, commonly referred to as the "NIS regulations", thereby improving cyber-resilience across critical sectors. The 2018 NIS regulations require essential parts of our economy to have appropriate cybersecurity measures in place. The European Union subsequently updated its framework through the NIS2 directive. The Bill provides an opportunity to strengthen the British Government's existing regime while minimising unnecessary regulatory divergence from the European Union. There are three practical ways in which the Bill does that. First, it widens the scope of the regime. For example, it brings into scope new categories such as medium and large data centres, large load controllers, medium and large managed service providers and designated critical suppliers. Secondly, it strengthens the regulatory toolkit. For example, it updates arrangements for incident reporting, information sharing and enforcement. Thirdly, it makes the framework more adaptable. For example, it enables further changes to be made through secondary legislation and provides powers for targeted action in response to imminent or evolving cyberthreats. While much of the subject matter is technical, the Bill should not be viewed simply as an IT measure. At its heart are matters of governance, resilience and accountability, ensuring that appropriate duties, regulatory oversight and powers exist to protect the network and information systems on which our essential services depend. The Department of Finance is designated as the NIS competent authority for the operation of essential services across the devolved sectors of transport, specifically road and rail; energy, including electricity, gas and oil; drinking water supply and distribution; and health. For the Department, that is an evolution of its role and a strengthening of the existing framework rather than the creation of a wholly new cyber regime or a fundamental change to the Department's role as the competent authority. My Department will continue to work collaboratively with the operators of those essential services and the respective Departments to ensure that they meet their regulatory requirements, safeguard their services and benefit from the best possible advice and support available in this rapidly evolving field. I now turn to why the consent of the Assembly is being sought. On 21 July, following changes to the machinery of government under the Prime Minister, Andy Burnham, responsibility for digital and online safety functions transferred from the Department for Science, Innovation and Technology (DSIT) to the Department for Digital, Culture, Media and Sport (DCMS). References to DSIT in the legislative consent memorandum were correct when it was drafted. However, responsibility for leading the Bill's passage now rests with DCMS. The British Government's position is that the Bill's provisions fall within the telecommunications and national security reservations. However, implementation of the NIS regulations and the Bill's provisions also intersect with devolved responsibilities. A number of essential services that are subject to the regime operate in devolved sectors, and certain provisions of the Bill alter the executive functions of the Department of Finance. Following the Bill's introduction, further engagement was required with DSIT on the devolution analysis and the assessment of the Bill under the Windsor framework. For that reason and in accordance with Standing Order 42A(4)(b), on 15 November 2025, I laid before the Assembly a memorandum setting out the content of the Bill and explaining why a legislative consent motion was not being sought at that stage. Following further engagement, 22 clauses were presented as requiring the consent of the Assembly. Departmental officials considered that a further six clauses affected the Executive competence of the Department of Finance and should therefore also be included in the request for consent. On 9 June 2026, I subsequently laid a legislative consent memorandum under Standing Order 42A(4)(a) providing details of the relevant provisions and the rationale for seeking the Assembly's consent. The Committee for Finance published its report on 24 June 2026 and agreed to support my request for the Assembly's endorsement of the legislative consent motion. I take the opportunity to thank members of the Committee for their support during that process. Consideration has also been given to the Bill's implications for human rights, equality and the Windsor framework. The Bill is considered to be compliant with the Windsor framework, and no denial of rights has been identified. Maintaining appropriate regulatory alignment and arrangements applying across Europe and Britain also helps to ensure that people here continue to benefit from a comparable level of cyber protection for essential services, reducing the risk associated with those services operating under an outdated regulatory framework. In terms of regulatory impact, stronger cyber-resilience requirements are expected to increase the need for cybersecurity capability and skills, which may, in turn, create opportunities for our local tech companies and digital sectors. The operators of essential services may incur additional compliance and investment costs as they respond to strengthened cybersecurity and supply chain requirements. However, given the nature of the operating environment, they should be seen as good governance and an investment, rather than additional burdens. It is not anticipated that smaller businesses will be adversely impacted. I will also briefly update Members on the Bill's passage through Westminster. The Bill has progressed through the House of Commons and the House of Lords. At Committee Stage in the House of Lords, the Government tabled amendments to strengthen the management of risks arising from vendors supplying operators of essential services through the proposed introduction of a new vendor risk management framework. Those arrangements were not moved following an objection. They are not considered to engage devolved competence in a manner that would require a further legislative consent motion, although they may be re-tabled when the Bill returns to the House of Commons. Report stage in the second Chamber is scheduled for 22 October 2026. The essential services that our society and economy depend on are increasingly reliant on interconnected digital systems. The consequences of disruption to those systems can extend well beyond an individual organisation or sector. Maintaining appropriate regulatory alignment with Europe and Britain will help ensure that people here continue to benefit from comparable cybersecurity protections for essential services. More fundamentally, cyberthreats do not recognise boundaries. Effective regulations, strengthened organisational resilience and coordinated action are therefore essential if we are to safeguard the critical services that our society and economy depend on. The Bill represents an important strengthening of the existing NIS framework. It builds on the regime already in place, strengthens its effectiveness and ensures that it is better equipped to respond to an evolving cyber threat environment. The motion seeks the Assembly's endorsement of the principles of extending the relevant provisions of the Cyber Security and Resilience (Network and Information Systems) Bill to this jurisdiction. I therefore commend it to the Assembly.
Go raibh maith agat, a Phríomh-Leas-Cheann Comhairle.
Again, I thank the Committee for its scrutiny of the LCM and the report that it has published. Mr O'Toole mentioned cross-border data and the need for regulatory cooperation and coherence across the border. That presents similar challenges to Governments across the globe. There is broad alignment between the Bill and the approach that has been taken by international colleagues, including the European Union. The British Government continue to engage constructively on that issue with the EU through the UK-EU cyber dialogue. The EU's NIS 2 directive covers more sectors and captures a wider range of entities, including the food sector, chemical industries and postal services. There is continued cross-jurisdictional cooperation on that matter. When it comes to big tech companies etc, we have to be concerned. We have to ensure that Governments, rather than large corporations, are setting the agenda on these matters. You will understand that that falls outside my remit at this time. However, I share your concerns about large tech companies, rather than democratically elected Governments, being able to set the agenda. I end my remarks by commending the LCM to the House. It is important legislation. As I said in my opening remarks, we always have to be conscious of and all play our part in cybersecurity.

1,454 words. Text as published by the Northern Ireland Assembly.

Assessment

Awaiting analysis

This record has not been analysed yet. It is not counted in any total until it has been assessed.

Disagree with this assessment?

Classifications can be challenged. A person reviews every challenge, and any change is recorded publicly above with its reason.

Challenge this classification