---

Cyber Security and Resilience (Network and Information Systems) Bill

My Lords, I have listened carefully to what the Minister has said. I had hoped that we would get greater clarity; I fear that the fog has increased. I entirely accept the point that companies have a general duty to take as many preventive measures as they can to increase security. That is a different matter, it seems, from what should trigger the reporting duty. Precisely what the Minister has laid out leads to a situation of an overload of reporting of items that do not require that kind of treatment.

I am extremely concerned that the industry fears—and it has a real point—that it will be caused to be active in areas which lead the regulators to be swamped and which reduces the real level of security, because it is doing things that it does not really need to. For those of us who are willing to contemplate a system of

regulation that allows for differentiation between sectors—in other words, a sectoral approach—it is the kind of thing that will lead to a terrible muddle. I am unhappy about the response that has been given to that general point. It strengthens the cause of those who say that we should have one general regulator and that it should set the rules.

Secondly, on the question of data centres, I cannot understand that a data centre could alter the rules under which companies, if they happen to be located in a data centre, are operating and doing their business. I fear that this is an issue to which we will have to return on Report, because as things stand we are not heading in the right direction. I beg leave to withdraw the amendment.