• Fines could be as much as £17 million or 4 per cent of global turnover
• NIS Directive will help make UK most secure place to live and do business online

Organisations who fail to implement effective cyber security measures could be fined as much as £17 million or 4 per cent of global turnover, as part of plans to make Britain’s essential networks and infrastructure safe, secure and resilient against the risk of future cyber attacks.

The plans are being considered as part of a consultation launched today by the Department for Digital, Culture, Media and Sport to decide how to implement the Network and Information Systems (NIS) Directive from May 2018.

Fines would be a last resort, and they will not apply to operators that have assessed the risks adequately, taken appropriate security measures, and engaged with competent authorities but still suffered an attack.

The NIS Directive relates to loss of service rather than loss of data, which falls under the General Data Protection Regulations (GDPR).

It will help make sure UK operators in electricity, transport, water, energy, transport, health and digital infrastructure are prepared to deal with the increasing numbers of cyber threats. It will also cover other threats affecting IT such as power failures, hardware failures and environmental hazards.

Minister for Digital Matt Hancock said:

We want the UK to be the safest place in the world to live and be online, with our essential services and infrastructure prepared for the increasing risk of cyber attack and more resilient against other threats such as power failures and environmental hazards.

The NIS Directive is an important part of this work and I encourage all public and private organisations in those sectors to take part in this consultation so together we can achieve this aim.

The NIS Directive, once implemented, will form an important part of the Government’s five-year £1.9 billion National Cyber Security Strategy. It will compel essential service operators to make sure they are taking the necessary action to protect their IT systems.

The Government is proposing a number of security measures in line with existing cyber security standards.

Operators will be required to develop a strategy and policies to understand and manage their risk; to implement security measures to prevent attacks or system failures, including measures to detect attacks, develop security monitoring, and to raise staff awareness and training; to report incidents as soon as they happen; and to have systems in place to ensure that they can recover quickly after any event, with the capability to respond and restore systems.

Any operator which takes cyber security seriously should already have such measures in place.

The Government is fully committed to defending against cyber threats and a five-year National Cyber Security Strategy (NCSS) was announced in November 2016, supported by £1.9 billion of transformational investment. The strategy includes opening the National Cyber Security Centre and offering free online advice as well as training schemes to help businesses protect themselves.

NCSC CEO Ciaran Martin said:

We welcome this consultation and agree that many organisations need to do more to increase their cyber security.

The NCSC is committed to making the UK the safest place in the world to live and do business online, but we can’t do this alone.

Everyone has a part to play and that’s why since our launch we have been offering organisations expert advice on our website and the Government’s Cyber Essentials Scheme.

The consultation proposes similar penalties for flaws in network and information systems as those coming for data protection with the General Data Protection Regulation, due to be in force by May 2018. Failure to implement effective security could see penalties as large £17 million or 4 per cent of global turnover.

The Government will shortly hold workshops with operators so they can provide feedback on the proposals.

Notes to editors

For media enquiries please contact the DCMS News and Communications team on 020 7211 2210 or out of hours on 07699 751153.

• The consultation documents are available online.

• The Government has committed to NIS Directive and is consulting on a number of issues:

• The essential services the directive needs to cover
• The penalties
• The competent authorities to regulate and audit specific sectors
• The security measures we propose to impose
• Timelines for incident reporting;

• How this affects Digital Service Providers

• This initiative is part of the Government’s £1.9 billion investment to significantly transform the UK’s cyber security. The 2016-2021 National Cyber Security Strategy sets out how the UK Government will deliver a UK that is secure and resilient to cyber threats; prosperous and confident in the digital world. The National Cyber Security Programme managed by the Cabinet Office coordinates the work undertaken to implement the UK’s National Cyber Security Strategy.

Welcome to the Residence. Congratulations to all of you on your graduation. Your hard work, and your training at UCBC will stand you in good stead for the future. And I wish you all the very best for that future.

A special aspect of UK Chile relations in the last year was the visit of His Royal Highness, Prince Edward, The Earl of Wessex last September. This included visiting UCBC, and I know many of you had the chance to meet him. During his visit, The Prince also promoted The Duke of Edinburgh’s International Award Foundation. As you may have seen in the press, yesterday, HRH The Duke of Edinburgh completed his last engagement of his public programme, although His Royal Highness may still attend events alongside Her Majesty, The Queen, from time to time. He is retiring, at the age of 96, after 70 years of public service. An inspiration to us all.

The Duke of Edinburgh’s International Award is the world’s leading youth achievement award. I have just received a copy of a book, published in aid of the Foundation. This is ‘Advice for School Leavers’, compiled by Will Jones, and with a foreword by HRH Prince Edward. It seems equally applicable for those of you leaving UCBC. As Prince Edward says “it includes advice from people from many walks of life, on choosing the right job, having the right approach to life in the business environment and getting the most out of both…It is down to you to make the most of …advice, your experiences …and to take on the world.”

There are many different perspectives in the book, but I would like to quote some of the words of John May, Secretary General, of The Duke of Edinburgh’s International Award. He suggests eight “touchstones” to guide his decisions and actions.

• “Respect for others …do unto others as you would have them do unto you.
• Equity – fairness and honesty in all dealings.
• To do my best – if a thing’s worth doing it is worth doing properly.
• Integrity – keeping promises.”

I know many of you have been studying Shakespeare and he quotes Polonius’s exhortation to his son in Hamlet – “This above all: to thine own self be true.” Something my university tutor instilled in me.

• “Carpe diem – or seize the day.
• Self confidence – but a self awareness that mitigates against self importance.
• A youthful, playful, joyful, perpetual curiosity.
• Balance – trying not to be too intense or too earnest or over-demanding of others.”

Good principles, which we can all think about, and learn from, including me.

As you go to start your new lives, I hope you will reflect on your time at UCBC, the inspiration of your teachers and training, and seize the day and the future ahead of you. And in doing so, that you will draw on your unique experiences of the links between British and Chilean cultures, and also be Ambassadors for shared relations between UK and Chile.