Cyber Security and Resilience Bill: What Schools and IT Providers Should Watch

Current status

This article covers proposed legislation currently progressing through Parliament. While not yet law, schools and IT providers should prepare for its likely implications.

At a glance

• Mandatory Incident Reporting: The Bill introduces stricter, legally binding timelines for reporting cyber incidents.
• Supply Chain Scrutiny: IT providers servicing the education sector may face new, mandatory compliance checks and audits.
• Ransomware Restrictions: Proposed limitations on ransomware payments and mandatory reporting before any payments are negotiated.

What is the Cyber Security and Resilience Bill?

Announced in the King's Speech, the Cyber Security and Resilience Bill aims to strengthen the UK's defences against the growing threat of cyber-attacks, particularly against critical infrastructure and essential services. While the education sector has historically occupied a grey area regarding "critical infrastructure," the severe disruption caused by recent attacks on schools and trusts has brought the sector into sharp focus.

Key Impacts for the Education Sector

1. Mandatory Incident Reporting

Schools are already required to report data breaches to the ICO under GDPR. However, the new Bill proposes mandatory reporting of cyber incidents to central authorities (likely the NCSC), regardless of whether personal data was exfiltrated. The focus is on operational disruption and threat intelligence sharing.

2. The IT Supply Chain

Perhaps the most significant change will fall on Managed Service Providers (MSPs) and IT support companies that service schools. The Bill intends to expand regulatory oversight to the supply chain. IT providers may be forced to prove they meet stringent security baselines before they are permitted to hold contracts with public sector bodies, including MATs.

3. Ransomware and Extortion

In an effort to choke off the funding model for cybercriminals, the Bill includes provisions that would force organisations to legally declare their intention to pay a ransom, and potentially introduces licensing regimes or outright bans on payments in certain sectors.

How to prepare

• Review your IT Provider's Accreditations: Ask your MSP if they hold Cyber Essentials Plus, ISO 27001, or similar accreditations that demonstrate their own internal security posture.
• Update your Risk Register: Ensure that supply chain cyber risk is formally documented on your trust or school risk register.
• Watch this space: The legislation is still being drafted, but the direction of travel is clear. Stricter accountability is coming.