Committee
Economy and Fair Work Committee 04 March 2026 [Draft]
04 Mar 2026 · S6 · Economy and Fair Work Committee
Item of business
Cyber Security and Resilience (Network and Information Systems) Bill (UK Parliament Legislation)
Good morning. I think that this is the first time that I have been to the Economy and Fair Work Committee as justice secretary. However, in a previous session, in the dim and distant past, I served for a wee while on this committee—I think with Willie Coffey at some point.I am pleased to be here to discuss the legislative consent memorandum, which will enable several clauses of the Cyber Security and Resilience (Network and Information Systems) Bill to take effect in Scotland. Cyberthreats are growing in scale and sophistication, and they pose a real threat and risk to essential services that people, communities and businesses rely on every day. As systems become more digitally interconnected, the impact of any single incident can spread very quickly. We must therefore make sure that our laws and regulations keep pace with the change in risk and the evolving challenge.The bill strengthens and updates the existing network and information systems regulations and expands the scope to include digital and operational services, such as managed service providers, large data centres, large load controllers and designated critical suppliers, all of which play a major role in the delivery of essential national activities. The bill also strengthens the powers of competent authorities in key areas, including information gathering, incident reporting, cost recovery and enforcement.In addition, the bill provides the United Kingdom Government with the tools to ensure a consistent strategic direction for the UK. That includes powers for the secretary of state to publish strategic priorities, issue a code of practice for regulators and direct operators of essential services and competent authorities where there are national security concerns. For those measures to be effective, they must be applied consistently across all four nations. Many operators, regulators and suppliers work across national borders, and fragmented arrangements could create avoidable burdens that would weaken our collective resilience. A co-ordinated approach is strongly supported by stakeholders, and it also aligns with the ambitions that we set out in the updated strategic framework for a cyber resilient Scotland, which I launched in November last year.The Scottish Government therefore proposes legislative consent for clauses related to critical suppliers, incident reporting, cost recovery, information gathering, information sharing, content of guidance, financial penalties, enforcement, appeals, code of practice, progress reporting and inspections. Those changes will give competent authorities, including Scottish ministers and the Drinking Water Quality Regulator for Scotland, enhanced powers to ensure cybersecurity and resilience across devolved sectors. Expanding the scope to include managed service providers and critical suppliers reflects the reality of complex supply chains and the potential impact of cyber incidents across sectors. It also directly supports the ambitions in our strategic framework.However, parts of the bill are still subject to on-going discussions with the UK Government. Those include provisions where current drafting lacks explicit requirements to consult or seek consent before altering Scottish ministers’ executive competence or before amending acts of the Scottish Parliament through secondary UK legislation. Those matters are likely to form the basis of a supplementary legislative consent motion in the coming months, as the bill progresses.Cybersecurity and resilience are shared responsibilities. The bill offers important and timely improvements to the UK’s cyber regulatory framework, and we support measures that strengthen our ability to protect critical services in Scotland.
In the same item of business
09:00
The Deputy Convener
SNP
Under agenda item 2, I welcome to the meeting the Cabinet Secretary for Justice and Home Affairs, Angela Constance. She is accompanied by Scottish Government...
The Cabinet Secretary for Justice and Home Affairs (Angela Constance)
SNP
Good morning. I think that this is the first time that I have been to the Economy and Fair Work Committee as justice secretary. However, in a previous sessio...
The Deputy Convener
SNP
Thank you, cabinet secretary. I will open with the first question.You have set out some of the context. It appeared to me, in preparing for this evidence ses...
Angela Constance
SNP
:Before I get into the specifics of that, I will give some context in order to underline the importance of the work that we are doing with the UK Government ...
The Deputy Convener
SNP
I know that you might not want to be drawn on this, but what are your predictions of how this might pan out? In your framing, you have made it clear that the...
Angela Constance
SNP
:It is difficult to answer that question without going through the bill clause by clause. As I said, we are still in negotiations, and I want to be respectfu...
The Deputy Convener
SNP
A lack of scrutiny.
Angela Constance
SNP
:—changing our primary legislation is fundamentally concerning. I would hope that we are in consensus about that, at least in this Parliament.
The Deputy Convener
SNP
I think that that is clearly understood.My follow-on question is on timescales. I know that there has been a carry-over motion in Westminster. Set against th...
Angela Constance
SNP
:Any future LCM will fall to the next session of Parliament. By way of some reassurance, ministerial work does not stop during purdah. There are significant ...
The Deputy Convener
SNP
We have a supplementary question from Mr Stewart.
Kevin Stewart (Aberdeen Central) (SNP)
SNP
Good morning, cabinet secretary. There is quite a long timescale for the bill. Earlier, I was relating to committee members a question that I was asked by a ...
Angela Constance
SNP
:The point about the criminal world and the changing nature of crime and offending is that things are moving at pace. As was indicated earlier, the threat is...
The Deputy Convener
SNP
Gordon MacDonald also has a supplementary.
Gordon MacDonald (Edinburgh Pentlands) (SNP)
SNP
Good morning. As you quite rightly said, cabinet secretary, the bill will not come fully into force until 2028, so I am keen to understand what we can do in ...
Angela Constance
SNP
:The Scottish Government and our partners use the strategic framework for a cyber resilient Scotland, which was launched in 2021. It was published in the aft...
The Deputy Convener
SNP
Before I bring in the next colleague, I want to ask one more question. Not that long ago, I was out with the Finance and Public Administration Committee in L...
Angela Constance
SNP
:I have not been to Lithuania, just for the record, but I do not know whether Mr Chapman or any of his colleagues have been there.
Paul Chapman (Scottish Government)
We have spoken to a number of countries across Europe at various levels about the differences in their architecture and how they have done it. A lot of them ...
The Deputy Convener
SNP
Thank you.
Murdo Fraser (Mid Scotland and Fife) (Con)
Con
Good morning, cabinet secretary. I want to move on to some slightly more practical issues with regard to the legislation. I appreciate this is not a Scottish...
Angela Constance
SNP
:Broadly speaking, yes. As the bill updates existing regulations, it is not expected that there will be any immense or unwieldy costs. We are continuing to m...
Paul Chapman
The bill gives the power to designate critical suppliers, but designation is very much seen as a last resort by most of the competent authorities that are ou...
Murdo Fraser
Con
:The bill suggests that the cost will be £12 million across the UK, and it might be assumed that Scotland will bear a proportionate share of that across the ...
Angela Constance
SNP
:Not just now. I point out that SMEs are currently below the threshold for registration as operators of essential services. That said, we will be cognisant o...
Murdo Fraser
Con
:Thank you.
The Deputy Convener
SNP
Stephen Kerr has a supplementary.
Stephen Kerr (Central Scotland) (Con)
Con
I just wanted to ask Paul Chapman about the expected number of critical suppliers, given the criteria that he has set out.
Paul Chapman
It will be vastly different across the UK and will depend on the sectors in which they are designated. Some of the larger sectors—for example, the more reser...