Chamber and committees

:That is the initial reporting, and then there would have to be follow-up reporting. There will be a new duty under the bill when it is enacted, but speed is of the essence, given our reliance on public services. We have to be able to get information quickly, so that Police Scotland or the Scottish cyber co-ordination centre can get information out to other bodies that might be impacted.

:I will begin, before handing over to Mr Chapman.

Ms Boyack makes a good point about the cost of doing nothing. There is a cost to the crime and the threat and therefore a cost to doing nothing, which must also be considered.

The Scottish Government is the competent authority for health services and the Scottish Water regulatory body is the competent authority for the water sector. We came to an agreement about cross-border rail, but that was before my time.

:The same logic behind having a common approach across the UK—bearing in mind that, geographically, we are an island and businesses operate across geographical boundaries—applies to the European context as well. It is a stated aim of this Government that we want to maintain alignment with the EU, and we believe that that is in the interests of business.

There are businesses in Scotland and the UK that operate across the UK and in Europe. Because they operate in Europe, those businesses need to comply with the NIS2 directive and the EU’s Cyber Resilience Act. That partly helps to alleviate the concerns that were expressed earlier about additional burdens and costs, because there are many businesses that are already operating to a particular standard.

:No.

:The Scottish Government and our partners use the strategic framework for a cyber resilient Scotland, which was launched in 2021. It was published in the aftermath of and in response to the Covid-19 pandemic, which changed our view and forced modernisation in some areas, particularly in relation to the use of technology and its role in public services and public safety. At the end of last year, the framework was updated. We cannot change the law, but the purpose of the framework is to ram home the fact that there are cyber risks that need to be recognised and managed across the public, private and third sectors.

Scotland has a flourishing cybersecurity industry, including a research community and a skilled cybersecurity workforce, so we need to galvanise that. On the nuts and bolts, the CyberScotland partnership brings together cross-sectoral partners, and the national cyber resilience advisory board gives advice and direction to Scottish ministers and the Scottish Government. The Scottish cyber co-ordination centre provides the central co-ordination function for improved intelligence sharing and early warnings, and national incident co-ordination for the public sector in Scotland. The centre is principally led and supported by the Scottish Government, but it has a secondee from Police Scotland. It is about being able to give information that contributes to intelligence and the management of threat. Police Scotland has also recently set up its cyber and fraud unit.

:Not just now. I point out that SMEs are currently below the threshold for registration as operators of essential services. That said, we will be cognisant of any changes that are made. There is a bit of a road for the bill to travel, and we need to be alert to that.

:I spoke about the core purpose of the strategic framework for a cyber resilient Scotland, which tries to look at the whole system and the whole country, including the public sector, industry and the third sector. We must go deeper and further and that will be a crucial part of the work of economy ministers and others, such as health ministers, who need to be in that terrain.

:Indeed. The digital directorate in the Scottish Government is core and fundamental to all this. However, if the committee would like me to pursue further information with other ministers, I would be delighted to do so.

:Any future LCM will fall to the next session of Parliament. By way of some reassurance, ministerial work does not stop during purdah. There are significant constraints on making major or impactful decisions, and you will not see substantial announcements or things like that, but some work continues, particularly at official level.

On the UK Government’s timetable for the bill, right now, it does not anticipate royal assent until early 2027, with the bill being fully in force in late 2028.

At the start of February 2026, the bill went to committee stage in the House of Commons, and in late summer and early autumn this year, the Department for Science, Innovation and Technology intends to consult on implementing policy. There will then be further consultation on strategic priorities. There is still a journey to go on with the bill, important as it is.

09:15

:Before I get into the specifics of that, I will give some context in order to underline the importance of the work that we are doing with the UK Government on what is a reserved matter that impacts devolved services.

The National Cyber Security Centre noted in its annual review, last October, that it had dealt with 204 nationally significant cyberattacks against the UK in the 12 months to August 2025. That was a sharp rise from 89 in the previous year. It is important that we bear in mind the context of that increasing threat, which is becoming increasingly sophisticated. That is the fundamental and core focus.

We support many of the amendments, particularly around the update to the Network and Information Systems Regulations 2018. Most of the discussions that we are having are, as the deputy convener identified, with reference to the powers conferred on the secretary of state—in essence, clauses 25 to 41.

Although, as a point of principle, we broadly support the additional powers conferred on the secretary of state, we have concerns, which are subject to further dialogue, about where those powers have the potential to alter the executive competence of the Scottish Government or to amend acts of the Scottish Parliament through secondary legislation without the explicit need to consult or seek the consent of Scottish ministers.

We always take a pragmatic view on such things, particularly about what will work in practice when the legislation is implemented. There is a very good relationship between my officials and the Department for Science, Innovation and Technology—they work well together. However, it is fair to say that there is a difference of view on some of the amendments.

In this area of the bill, we are giving consent to only one clause—clause 38—and withholding consent on the rest at this time, in order to allow for further discussions. The discussions tend to proceed quite slowly. In my experience, they are rarely done rapidly, and there are all sorts of reasons for that.

At the start of February, the UK Government gave us its view that it did not think that any further drafting or amendment of the clauses was required. Scottish Government officials, including from the legal directorate, have compiled a view. We wrote to the UK Government last month, and we are still waiting for a response.