UK government proposes radical cyber laws to bolster public sector resilience and curb ransomware payments

More on this

1. https://wmbdradio.com/2025/11/11/uk-plans-tougher-laws-to-protect-public-services-from-cyberattacks/ - Please view link - unable to able to access data
2. https://www.reuters.com/world/uk/uk-plans-tougher-laws-protect-public-services-cyberattacks-2025-11-12/ - The UK government has announced plans to enhance cybersecurity regulations aimed at protecting public services from increasing cyberattacks. The proposed legislation would impose strict security obligations on medium and large companies that provide IT-related services, such as cybersecurity, management, and help desk support, to both public and private sector institutions, including the NHS. This move follows a series of significant cyber incidents in 2024 and 2025, including breaches affecting the Ministry of Defence and a cyberattack that disrupted more than 11,000 NHS medical appointments. The Department for Science, Innovation and Technology (DSIT) outlined that companies with trusted network access must meet clear security standards. The laws would require timely reporting of major cyber incidents and preparation of effective response plans. Regulators would be given authority to designate certain suppliers as critical to national services, and breaches could lead to tougher penalties. Additionally, public sector organizations and critical infrastructure operators, like local councils, schools, and the NHS, would be prohibited from paying ransoms to cybercriminals.
3. https://www.gov.uk/government/news/tough-new-laws-to-strengthen-the-uks-defences-against-cyber-attacks-on-nhs-transport-and-energy - The UK government has introduced new legislation to bolster cyber defences for essential public services, including healthcare, transport, and energy sectors. The Cyber Security and Resilience Bill aims to strengthen national security and protect economic growth by enhancing cyber protections for services that the public and businesses rely on daily. The proposed laws would cover certain digital and essential services, such as healthcare, transport, energy, and water. Under the proposals, medium and large companies providing services like IT management, IT help desk support, and cybersecurity to private and public sector organisations like the NHS would be regulated for the first time. These companies would need to meet clear security duties, including reporting significant or potentially significant cyber incidents promptly to the government and their customers, as well as having robust plans in place to deal with the consequences. Regulators would be given new powers to designate critical suppliers to the UK's essential services, such as those providing healthcare diagnostics to the NHS or chemicals to a water firm, where they meet the criteria. This would mean they'd have to meet minimum security requirements, shutting down gaps in supply chains criminals could exploit, which could cause wider disruption. Enforcement would be modernised, including tougher turnover-based penalties for serious breaches, so cutting corners is no longer cheaper than doing the right thing. The Technology Secretary would get new powers to instruct regulators and the organisations they oversee, like NHS trusts and Thames Water, to take specific, proportionate steps to prevent cyber attacks where there is a threat to UK national security. This includes requiring that they beef up their monitoring or isolate high-risk systems to protect and secure essential services.
4. https://www.gov.uk/government/news/uk-to-lead-crackdown-on-cyber-criminals-with-ransomware-measures - The UK government has unveiled measures to tackle the threat of ransomware and protect businesses and critical services. Ransomware is malicious software used by cybercriminals to access victims' computer systems, encrypting systems and data or stealing data until a ransom is paid. Ransomware is estimated to cost the UK economy millions of pounds each year, with recent high-profile ransomware attacks highlighting the severe operational, financial, and even life-threatening risks. Public sector bodies and operators of critical national infrastructure, including the NHS, local councils, and schools, would be banned from paying ransom demands to criminals under the measure, with nearly three-quarters of consultation respondents showing support for the proposal. The ban would target the business model that fuels cybercriminals' activities and makes the vital services the public rely on a less attractive target for ransomware groups. Under the proposals, businesses not covered by the ban would be required to notify the government of any intent to pay a ransom. The government could then provide those businesses with advice and support, including notifying them if any such payment would risk breaking the law by sending money to sanctioned cybercriminal groups, many of whom are based in Russia. Mandatory reporting is also being developed, which would equip law enforcement with essential intelligence to hunt down perpetrators and disrupt their activities, allowing for better support for victims.
5. https://www.gov.uk/government/news/world-leading-proposals-to-protect-businesses-from-cybercrime - The UK government has announced world-leading proposals to protect businesses from cybercrime, aiming to tackle the threat of cybercrime, which is estimated to cost the UK economy billions of pounds every year. Ransomware is malicious software that infects a victim’s computer and demands a ransom from them in order to give them back access to their system, for their data to be restored, and often for the hackers not to publish the victim’s data on the web. Aiming to strike at the heart of the cybercriminal business model and protect UK businesses by deterring threats, proposals include banning all public sector bodies and critical national infrastructure, including the NHS, local councils, and schools, from making ransomware payments, in order to make them unattractive targets for criminals. A mandatory reporting regime for ransomware incidents – bringing ransomware out of the shadows and maximising the intelligence used by UK law enforcement agencies to warn of emerging ransomware threats, and target their investigations on the most prolific and damaging organised ransomware groups. The NCSC (National Cyber Security Centre) managed 430 cyber incidents between September 2023 and August 2024, including 13 ransomware incidents which were deemed to be nationally significant and posed serious harm to essential services or the wider economy. Reporting to the NCA (National Crime Agency) indicates the number of UK victims appearing on ransomware data leak sites has also doubled since 2022. With the Crime Survey for England and Wales also estimating that almost a million (952,000) computer misuse offences were committed against individuals in England and Wales in the year ending June 2024, and new polling showing that 84% and 72% of the UK public are concerned about the threat of ransomware to UK infrastructure and businesses respectively, the government’s proposals set out necessary action to protect UK consumers, businesses, infrastructure and public services against the ransomware threat.
6. https://www.gov.uk/government/news/new-cyber-laws-to-safeguard-uk-economy-secure-long-term-growth - The UK government has set out the scope and ambition of the Cyber Security and Resilience Bill for the first time. Plans set out to bolster the UK’s online defences, protect the public and safeguard growth – the central pillar of the UK government’s Plan for Change. New measures will boost protection of supply chains and critical national services, including IT service providers and suppliers. Cyber Security and Resilience Bill to be introduced later this year to face down growing range of online threats. Hospitals and energy suppliers are set to boost their cyber defences under the new Cyber Security Bill, protecting public services and safeguarding growth as government delivers its Plan for Change.