Committee
Economy and Fair Work Committee 04 March 2026 [Draft]
04 Mar 2026 · S6 · Economy and Fair Work Committee
Item of business
Cyber Security and Resilience (Network and Information Systems) Bill (UK Parliament Legislation)
Good morning. As you quite rightly said, cabinet secretary, the bill will not come fully into force until 2028, so I am keen to understand what we can do in the short term. We have had a number of cybersecurity breaches—Western Isles Council in 2023, and West Lothian Council and Glasgow City Council in 2025—and reports into those incidents suggest that they were partly due to overdue information technology health checks, a lapse in public service network certifications and untested incident response plans.Given that these attacks happen regularly and that the bill will not come fully into force until 2028, what can we do in the short term to make sure that Scottish public services are looking after the nuts and bolts of the system before they have to worry about ransomware?
In the same item of business
09:00
The Deputy Convener
SNP
Under agenda item 2, I welcome to the meeting the Cabinet Secretary for Justice and Home Affairs, Angela Constance. She is accompanied by Scottish Government...
The Cabinet Secretary for Justice and Home Affairs (Angela Constance)
SNP
Good morning. I think that this is the first time that I have been to the Economy and Fair Work Committee as justice secretary. However, in a previous sessio...
The Deputy Convener
SNP
Thank you, cabinet secretary. I will open with the first question.You have set out some of the context. It appeared to me, in preparing for this evidence ses...
Angela Constance
SNP
:Before I get into the specifics of that, I will give some context in order to underline the importance of the work that we are doing with the UK Government ...
The Deputy Convener
SNP
I know that you might not want to be drawn on this, but what are your predictions of how this might pan out? In your framing, you have made it clear that the...
Angela Constance
SNP
:It is difficult to answer that question without going through the bill clause by clause. As I said, we are still in negotiations, and I want to be respectfu...
The Deputy Convener
SNP
A lack of scrutiny.
Angela Constance
SNP
:—changing our primary legislation is fundamentally concerning. I would hope that we are in consensus about that, at least in this Parliament.
The Deputy Convener
SNP
I think that that is clearly understood.My follow-on question is on timescales. I know that there has been a carry-over motion in Westminster. Set against th...
Angela Constance
SNP
:Any future LCM will fall to the next session of Parliament. By way of some reassurance, ministerial work does not stop during purdah. There are significant ...
The Deputy Convener
SNP
We have a supplementary question from Mr Stewart.
Kevin Stewart (Aberdeen Central) (SNP)
SNP
Good morning, cabinet secretary. There is quite a long timescale for the bill. Earlier, I was relating to committee members a question that I was asked by a ...
Angela Constance
SNP
:The point about the criminal world and the changing nature of crime and offending is that things are moving at pace. As was indicated earlier, the threat is...
The Deputy Convener
SNP
Gordon MacDonald also has a supplementary.
Gordon MacDonald (Edinburgh Pentlands) (SNP)
SNP
Good morning. As you quite rightly said, cabinet secretary, the bill will not come fully into force until 2028, so I am keen to understand what we can do in ...
Angela Constance
SNP
:The Scottish Government and our partners use the strategic framework for a cyber resilient Scotland, which was launched in 2021. It was published in the aft...
The Deputy Convener
SNP
Before I bring in the next colleague, I want to ask one more question. Not that long ago, I was out with the Finance and Public Administration Committee in L...
Angela Constance
SNP
:I have not been to Lithuania, just for the record, but I do not know whether Mr Chapman or any of his colleagues have been there.
Paul Chapman (Scottish Government)
We have spoken to a number of countries across Europe at various levels about the differences in their architecture and how they have done it. A lot of them ...
The Deputy Convener
SNP
Thank you.
Murdo Fraser (Mid Scotland and Fife) (Con)
Con
Good morning, cabinet secretary. I want to move on to some slightly more practical issues with regard to the legislation. I appreciate this is not a Scottish...
Angela Constance
SNP
:Broadly speaking, yes. As the bill updates existing regulations, it is not expected that there will be any immense or unwieldy costs. We are continuing to m...
Paul Chapman
The bill gives the power to designate critical suppliers, but designation is very much seen as a last resort by most of the competent authorities that are ou...
Murdo Fraser
Con
:The bill suggests that the cost will be £12 million across the UK, and it might be assumed that Scotland will bear a proportionate share of that across the ...
Angela Constance
SNP
:Not just now. I point out that SMEs are currently below the threshold for registration as operators of essential services. That said, we will be cognisant o...
Murdo Fraser
Con
:Thank you.
The Deputy Convener
SNP
Stephen Kerr has a supplementary.
Stephen Kerr (Central Scotland) (Con)
Con
I just wanted to ask Paul Chapman about the expected number of critical suppliers, given the criteria that he has set out.
Paul Chapman
It will be vastly different across the UK and will depend on the sectors in which they are designated. Some of the larger sectors—for example, the more reser...