I beg to move Amendment 26, in Clause 40, page 63, line 7, leave out “5” and insert “3”.

This amendment would increase the frequency of the reports that must be published under Clause 40, from every five years to every three years.

With this it will be convenient to discuss Clause stand part.

Amendment 26, tabled by my hon. Friend the Member for Henley and Thame, seeks to ensure that the Bill keeps pace with the reality that it seeks to regulate. In the world of cyber-security, five years is a lifetime. In the past five years, the size and scale of cyber-attacks has continued to advance at pace, and we can expect the next five years to be the same. In that context, waiting five years for the first formal parliamentary review of the Bill seems dangerous. It risks leaving us with a regulatory framework designed for the threats of yesterday and not tomorrow. The cyber-threat is real, evolving and urgent.

The NCSC has reported that nationally significant cyber-incidents more than doubled in 2025 alone. That is why the amendment would change the reporting cycle to once every three years. That is a pragmatic timeline, which allows the Government to identify gaps and close them before they are exploited. The EU’s NIS2 directive explicitly mandates a review by the Commission every three years, and it is not clear why the Government have decided to diverge from that standard. Is it because they believe that the cyber-threat here is considerably less than the one facing European member states? It is simply not clear, which adds to the general sense of bewilderment about this provision. If our European neighbours are reviewing their cyber-security approach every three years, why are the UK Government content to wait for five?

Clause 40 requires the Secretary of State to publish a report every five years on the operation of the NIS regulations and parts 3 and 4 of the Bill. Reports should include a review of any exercise of powers under parts 3 and 4 by the Secretary of State. Given the wide-ranging powers granted to the Secretary of State under those parts, I have some sympathy for Amendment 26, tabled by the hon. Member for Henley and Thame, which seeks to reduce reporting intervals from five years to three.

The Shadow Secretary of State, my hon. Friend Julia Lopez, raised this issue on Second Reading. She suggested that annual or biannual reviews might allow for effective parliamentary scrutiny of the NIS regulations and of the Secretary of State’s exercise of powers to respond to emerging threats. In view of the concerns voiced by the hon. Members for Henley and Thame and for Brecon, Radnor and Cwm Tawe, and by the shadow ministerial team, will the Minister explain why five-year intervals have been selected and whether the Government will look at this important issue again?

I thank the hon. Member for Brecon, Radnor and Cwm Tawe for moving Amendment 26, in the name of the hon. Member for Henley and Thame. It seeks to reduce the period for publishing a report on the operation of the legislation from at least every five years to at least every three. I reassure him that the Government recognise the importance of regular assessments of the regime to ensure that it is as effective as possible. The legislation sets five years as the minimum period. That is an appropriate and proportionate timeframe in which to meaningfully assess the progress, at a regular frequency, of the entire regime set out in the Bill, following the approach set by existing legislation such as the Online Safety Act 2023.

Mandating a report every three years may not be as effective because of the extensive nature of these reviews, given that this is a cross-sectoral regime, and would produce unnecessary administrative burdens. A report every five years is a minimum baseline, and the Government will be able to conduct more frequent reports on the legislation if that is deemed necessary. I must remind the Committee that this sits alongside the annual report on the statement of strategic priorities, which will also provide frequent monitoring of regulator activities in response to the objectives of the statement. For these reasons, I kindly ask the hon. Member for Brecon, Radnor and Cwm Tawe to withdraw the amendment.

As I have previously set out, it is essential that the framework is effective, properly implemented and keeps pace with the evolving cyber landscape, and we must have a mechanism to assess whether it is doing so. Clause 40 requires the Secretary of State to lay a report in Parliament at least every five years assessing how the Bill has met its objectives. That is an appropriate period for Government to meaningfully measure progress across all of the regulated sectors, but more frequent reports are possible if deemed necessary.

As we know, this is not the only mechanism for monitoring progress. Clause 28 requires more frequent annual reports to Parliament on regulator activities in relation to the objectives in the statement of strategic priorities. While these reports are crucial for effective monitoring, evaluation and long-term, evidence-based decision making, they are only part of the picture. Should urgent intelligence come to light, the Government will be able to act, including through the powers in the Bill. For those reasons, I commend clause 40 to the Committee.

I beg to ask leave to withdraw the Amendment.

Amendment, by leave, withdrawn.

Clause 40 ordered to stand part of the Bill.