UK infrastructure firms to face £17m fine if their cybersecurity sucks

[Solarquest]

Oh boy, measures will also cover IT outages
Infrastructure firms could face fines of up to £17m if they do not have adequate cybersecurity measures in place, the UK government has announced today.

The plans follow proposals earlier this year from the Department for Digital, Culture, Media and Sport intended to comply with the EU Network and Information Systems (NIS) Directive, which comes into effect next May.


The government intends to use those powers on grounds of national security; a potential threat to public safety; or the possibility of significant adverse social or economic impact resulting from a disruptive incident.

The powers will also cover other threats affecting IT such as power outages, hardware failures and environmental hazards. Critical infrastructure firms will also be required to show they have a strategy to cover such incidents.

The maximum penalty will be applied if firms are deemed to have not cooperated with the competent authority, failed to report an incident, not complied with the regulator's instruction, or failed to implement appropriate and proportionate security measures.

Under the measures recent cyber breaches such as WannaCry would be covered by the NIS Directive.

Threats against Blighty's national infrastructure appear to be increasing. In November, Ciaran Martin, chief exec of the National Cyber Security Centre (NCSC), revealed that hackers acting on behalf of Russia had targeted the UK's telecommunications, media and energy sectors.

Margot James, Minister for Digital and the Creative Industries, said: "Today we are setting out new and robust cybersecurity measures to help ensure the UK is the safest place in the world to live and be online.

"We want our essential services and infrastructure to be primed and ready to tackle cyber attacks and be resilient against major disruption to services."

Incidents will have to be reported to the regulator, which will assess whether appropriate security measures were in place. The regulator will have the power to issue legally binding instructions to improve security, and – if appropriate – impose financial penalties.

The measures will dramatically increase the limit regulators can impose on companies.
...
...

 

[Solarquest]

"The maximum penalty will be applied if firms are deemed to have not cooperated with the competent authority, failed to report an incident, not complied with the regulator's instruction, or failed to implement appropriate and proportionate security measures."

....this is the part I like the most... let's see and hope other will follow soon.

 

[Stopspying]

"The maximum penalty will be applied if firms are deemed to have not cooperated with the competent authority, failed to report an incident, not complied with the regulator's instruction, or failed to implement appropriate and proportionate security measures."

....this is the part I like the most... let's see and hope other will follow soon.

For far too long the 'authorities' charged with overseeing the cybersecurity of the UK's business sector have struck me as either being weak or reluctant to jump on offenders too heavily. I'm with you in hoping that other bodies will soon follow and respect the fact that cybersecurity is a subject to be treated with incredible seriousness. For too long our data has been leaked/hacked and nothing is done or said about the leaks for far too long.

A certain UK government minister has recently been banging on about the risks we face from Russian internet 'forces', there is a risk from them and many other nations and individuals. But part of his reasoning for doing so seems to be to provide a smokescreen for some newspapers digging into his personal life. Quel surprise! A government minister trying to avoid full disclosure!
Gavin Williamson under pressure over fireplace firm job | Politics | The Guardian
UK defence secretary is scaremongering about Russia - energy experts | Politics | The Guardian