Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q Thank you for giving evidence to us. I want your help to get my head around what could fall under the Bill’s discretionary power on the designation of critical supply chain entities. Synnovis is used as the exemplar of why such a power is needed. From your perspective in the NHS, what do you think would come into scope? For example, would patient transport or taxis come under scope as critical for the delivery of your services? Would a hospital cleaner come under the scope of a critical supplier if the service was outsourced to a private sector organisation? Would food provision in your hospital come under scope? Would the provision of materials, medicines or medical devices provided by private companies come under scope? Would the provision of IT services—physical computers, not cloud services—come under scope? Would locum agencies come under scope? In fact, would any private provider not come under the scope as critical for the provision of services linked to your organisation’s IT system? Brian Miller: That is a good question. Some of our colleagues mentioned the follow-up secondary legislation that will help us to identify those kinds of things. I suppose there is no difference from where we are at now. We would look at any provision of services from a risk management perspective and say what security controls apply. For example, would they be critical suppliers in terms of infrastructure and cyber-security? Does a cleaning service hold identifiable data? What are the links? Is it intrinsically linked from a technological perspective? I mentioned looking at this through a “defenders win” lens. Yes, some of these technologies are covered. I saw some of the conversations earlier about local authorities not being in scope, but services are so intrinsically linked that they can well come into scope. It might well be that some of the suppliers you mentioned fall under the category of critical suppliers, but that might be the case just now. There might be provision of a new service for medical devices, which are a good example because they are unique and different compliance standards apply to them. For anything like that, where we stand just now—outside the Bill—we risk assess it. There is such an intrinsic link. A colleague on another panel mentioned data across the services; that is why Stewart is here alongside me. I look after the IT security element and Stewart looks after the data protection element.