Cyber Security and Resilience (Network and Information Systems) Bill – in a Public Bill Committee at 10:15 am on 24 February 2026.
“(1) The Secretary of State must, by regulations, make provision for the establishment and operation of a cyber security support service for relevant small and medium-sized enterprises (SMEs) for the purposes of improving the security and resilience of their network and information systems.
(2) For the purposes of this section, a relevant SME is one which is—
(a) an operator of an essential service,
(b) a relevant digital service provider,
(c) a relevant managed service provider, or
(d) a critical supplier
within the meaning of the NIS Regulations.
(3) A support service established under this section must provide—
(a) advice and technical assistance to SMEs following a cyber incident; and
(b) guidance on recovery and remediation.”—
This new clause would require the Secretary of State to establish a cyber security support service for relevant SMEs.
Freddie Van Mierlo
Liberal Democrat, Henley and Thame
I beg to move, That the Clause be read a Second time.
The new clause would place a statutory duty on the Secretary of State to establish a support service dedicated to improving the resilience of small and medium-sized enterprises and, crucially, to provide them with assistance when the worst happens. SMEs are the backbone of our economy. Their growth and continue operation are essential to a strong economy. We heard evidence that even large corporations find it hard to justify the investment in cyber-security and resilience when faced with competing priorities and investment needs. It forms the rationale of the Bill putting this need on a statutory footing, but small and medium-sized businesses undoubtedly find it even harder to make the investments required in cyber-security.
I know from having worked in SMEs at the start of my career that companies experience growing pains and need support in navigating complex statutory requirements. It is not just support for SMEs before an attack takes place that the clause would provide for, but also after. For SMEs, a cyber-attack is not just a disruption; it can be an existential threat to their existence. The clause would ensure that when an SME is hit, they have access to the support they need.
Bradley Thomas
Conservative, Bromsgrove
Given that the threshold for a significant impact event will likely be much lower for an SME than for a larger corporation, and while acknowledging and agreeing that SMEs are the backbone of the economy and make up the vast Majority of companies that employ people in this country, how does the hon. Gentleman propose to strike the relevant balance between ensuring that SMEs are supported, and at the same time that they are not inundated and overwhelmed as a result of that significant impact threshold likely being much lower for SMEs?
Freddie Van Mierlo
Liberal Democrat, Henley and Thame
The thresholds have been set out in the new Clause. Australia already provides support for small businesses during and after attacks. The clause would simply bring the UK up to speed with international partners, ensuring our businesses are not at a competitive disadvantage on cyber-security support. If Australia can support its SMEs, why can we not? It is only fair that if we are increasing the regulatory burden, the Government provide the support required to navigate it. I will press the new clause to a vote.
Ben Spencer
Shadow Minister (Science, Innovation and Technology)
New Clause 14, tabled by the hon. Member for Henley and Thame, addresses concerns regarding the capacity of SMEs to comply with their regulatory obligations, should they be brought within the scope of the Bill. That matter has been discussed on several occasions by the Committee. That is only right given that, according to figures provided by NCC Group, SMEs make up over 99% of businesses in the UK but too often lack the skills and budgets to implement proportionate cyber-protections, leaving them particularly exposed.
SME cyber assistance schemes akin to the one proposed by the new clause have been rolled out in Scotland on a limited basis and in Australia, where the Government are investing 8 million Australian dollars over three years to provide free person-to-person support for small businesses during and after a cyber-attack. Those schemes have enjoyed some success in hardening cyber-resilience among SMEs that have been able to access them. That can only be welcomed.
There is a case for looking more closely at whether regulation is the appropriate first step to address the cyber-resilience of the smallest organisations that might be brought within the scope of regulation, as legal compliance efforts could detract from already pressured operational defence budgets. In giving evidence to the Committee, Jill Broom of techUK called for strategies
“such as financial incentives, or…tax credits”––[Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee,
to help SMEs improve their cyber-resilience, and techUK has suggested that funding or relief could be applied on a priority basis, with those working within the critical national infrastructure supply chain looked at first. In the light of those considerations, what analysis has the Minister’s Department conducted of the likely return on investment, in terms of sustainability and growth among smaller companies, of a cyber support service for UK SMEs?
Kanishka Narayan
Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)
New Clause 14 would require the Government to establish a dedicated support service for small and medium-sized enterprises that are operators of essential services, relevant digital service providers, relevant managed service providers or critical suppliers. That would include provision of advice, technical assistance and recovery guidance following a cyber-incident. It is worth noting that the Bill exempts small and micro enterprises from the regulations as relevant digital service providers or relevant managed service providers. Although regulators can designate a small or micro entity as a critical supplier, very few are expected to meet the threshold for criticality in practice. Similarly, there are limited examples of small or micro operators of essential services.
Improving the cyber-security of our nation’s small and medium-sized businesses is important for the resilience of our wider economy. That is why the Government have developed a wide range of free tools, guidance and training to help those businesses implement cyber-security measures. Such tools include the recently launched cyber action toolkit, which provides small and medium-sized businesses with tailored advice and the offer of free 30-minute consultations with NCSC-certified cyber advisers. Report Fraud, a reporting service for cyber-crime and fraud, runs a 24/7 cyber business incident reporting line, with regional cyber-resilience centres across England and Wales also providing support for small and medium-sized businesses, including incident response and business continuity advice in line with NCSC standards.
I hope that reassures the hon. Member for Henley and Thame that there is already considerable support available for small and medium-sized entities. Considering that, a new dedicated service is unnecessary, and it could divert resources from existing Government and NCSC schemes and impact our efficacy. For those reasons, I hope he will withdraw the new clause.
Question put, That the clause be read a Second time.
Division number 9
Cyber Security and Resilience (Network and Information Systems) Bill — New Clause 14 - Cyber security support service for SMEs
A parliamentary bill is divided into sections called clauses.
Printed in the margin next to each clause is a brief explanatory `side-note' giving details of what the effect of the clause will be.
During the committee stage of a bill, MPs examine these clauses in detail and may introduce new clauses of their own or table amendments to the existing clauses.
When a bill becomes an Act of Parliament, clauses become known as sections.
Secretary of State was originally the title given to the two officials who conducted the Royal Correspondence under Elizabeth I. Now it is the title held by some of the more important Government Ministers, for example the Secretary of State for Foreign Affairs.
A parliamentary bill is divided into sections called clauses.
Printed in the margin next to each clause is a brief explanatory `side-note' giving details of what the effect of the clause will be.
During the committee stage of a bill, MPs examine these clauses in detail and may introduce new clauses of their own or table amendments to the existing clauses.
When a bill becomes an Act of Parliament, clauses become known as sections.
The term "majority" is used in two ways in Parliament. Firstly a Government cannot operate effectively unless it can command a majority in the House of Commons - a majority means winning more than 50% of the votes in a division. Should a Government fail to hold the confidence of the House, it has to hold a General Election. Secondly the term can also be used in an election, where it refers to the margin which the candidate with the most votes has over the candidate coming second. To win a seat a candidate need only have a majority of 1.
Ministers make up the Government and almost all are members of the House of Lords or the House of Commons. There are three main types of Minister. Departmental Ministers are in charge of Government Departments. The Government is divided into different Departments which have responsibilities for different areas. For example the Treasury is in charge of Government spending. Departmental Ministers in the Cabinet are generally called 'Secretary of State' but some have special titles such as Chancellor of the Exchequer. Ministers of State and Junior Ministers assist the ministers in charge of the department. They normally have responsibility for a particular area within the department and are sometimes given a title that reflects this - for example Minister of Transport.
The House of Commons votes by dividing. Those voting Aye (yes) to any proposition walk through the division lobby to the right of the Speaker and those voting no through the lobby to the left. In each of the lobbies there are desks occupied by Clerks who tick Members' names off division lists as they pass through. Then at the exit doors the Members are counted by two Members acting as tellers. The Speaker calls for a vote by announcing "Clear the Lobbies". In the House of Lords "Clear the Bar" is called. Division Bells ring throughout the building and the police direct all Strangers to leave the vicinity of the Members’ Lobby. They also walk through the public rooms of the House shouting "division". MPs have eight minutes to get to the Division Lobby before the doors are closed. Members make their way to the Chamber, where Whips are on hand to remind the uncertain which way, if any, their party is voting. Meanwhile the Clerks who will take the names of those voting have taken their place at the high tables with the alphabetical lists of MPs' names on which ticks are made to record the vote. When the tellers are ready the counting process begins - the recording of names by the Clerk and the counting of heads by the tellers. When both lobbies have been counted and the figures entered on a card this is given to the Speaker who reads the figures and announces "So the Ayes [or Noes] have it". In the House of Lords the process is the same except that the Lobbies are called the Contents Lobby and the Not Contents Lobby. Unlike many other legislatures, the House of Commons and the House of Lords have not adopted a mechanical or electronic means of voting. This was considered in 1998 but rejected. Divisions rarely take less than ten minutes and those where most Members are voting usually take about fifteen. Further information can be obtained from factsheet P9 at the UK Parliament site.
