Latest / The HIDDEN Podcast by Babble / Episode 13: The UK Cyber Security and Resilience Bill: What businesses need to know
Transcript
- mark: this isn't a case of if it's a case of when. The act will come into being and look, the act is a good thing. It's about making the UK and its critical businesses and its critical infrastructure more resilient cyber attack. So and I think leading on from that, it is just really good practice that I would certainly always recommend that a business gets ahead, it gets cyber secure, it gets resilient. And that's important for its own business, its own productivity, its employees and indeed its customers. So let's get ahead of the act and let's get cyber ready because it's just a good thing to do. Lynn: Welcome to the HIDDEN Podcast, where we simplify cyber security and all things tech for those of you who, like me, need it to be explained without all the jargon. So if you've ever wondered why you still feel vulnerable, even though you've bought all the fancy tools, you've come to the right place. I'm your host, Lynn Murape, and my job is to take one of our resident experts and help them translate their cyber expertise into plain English. This means having practical conversations usually built around Babble's HIDDEN cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Joining me in the virtual studio today for the very first time is Mark Weait, Chief Revenue Officer here at Babble. Mark, thank you so much for being here. mark: Yeah, great. And thank you for having me here, Lyn. Lynn: It's an absolute pleasure. So given that this is your first time on the show, do you mind telling our friends, listening or watching out there a little bit about yourself in terms of what you do and where you live? mark: Yeah, certainly. So, well, as you've already said, I'm Chief Revenue Officer. I've been at Babble now for what, between 12 and 18 months. And it's been a really exciting, busy time sort of getting into Babble and meeting with many of our customers and helping to drive our strategy forward in what are, you know, very exciting, but sometimes scary times out there in the market with resilience bills and cloud transformation and AI revolutions all going on at the same time. So, so yeah. So that's been a great time here. think to answer your question, where do I live? So I actually spend a lot of my time in Babble works across the UK. So I'm often found traveling up the M1 or M40 to various parts of the UK. My home is actually in the Southeast. I live near a place called Tunbridge Wells. And so most of time I'm working from our sort of headquartered office in London. Lynn: Awesome. Thank you so much for sharing. And it's honestly been such a treat to just see how you have revolutionized Babble. I hate using that word, but nonetheless, it's been a pleasure working with you. So you have a very strong background in cyber security, right? So do you mind telling us a little bit about that? mark: Yeah, so I actually have been working within, I guess, cloud, I would say cloud technology from my time, SAP from Tata and various other large corporates. So sort of networking and cloud was really my original home, but very quickly, probably over the last 10, 15 years, cyber security started becoming more and more present as a critical element of what businesses needed to do when deploying this technology. And I'd say within that time, I saw it from becoming what I'd call maybe a nice to have that some people knew to becoming a board critical matter of discussion where you CEOs are actually starting to take this and indeed have have a direct responsibility for ensuring their businesses are Cyber secure so it's been a massive journey and one that I've you know been very glad to be part of and excited to see shape in the way that it has Lynn: Yeah, I couldn't agree more. I mean, I am the layman in this situation, as you all know by now, but it's really so fascinating to see just how quickly this technology and the cyber security space as a whole has moved even in the last five to ten years, right? But bringing it back to today's topic at hand, which you've already touched on, the UK legislation. So there's a bit of UK legislation making its way through Parliament right now as we speak. It is known as the cyber security and Resilience bill, and that's going to reshape what good cyber governance looks like over the next couple of years, whether or not a business thinks it applies to them directly. So, yes, it's not law yet, and the detail is still being worked through, but that's exactly why this is the right moment to ask those questions while you still have the time to prepare, right? So there's a bit to unpack, so without further ado, we're just going to jump right in by just talking about what's changing and who's affected. So Mark, to kick us off, you know, we're hearing a lot of noise about the UK cyber security and resilience bill. Where are things now? And in your opinion, is this actually going to happen? mark: So firstly, let me take your second question. Yes, I think it's absolutely going to happen. I think that, you know, you only have to look at the news on weekly basis, whether that was, you know, cyber outages in the health service in with Jaguar. They're not abating and the cyber criminals are getting more and more aggressive in how they attack it. And it's one of the fastest growing industries in the world. So as a result, you know, the UK is doing the right thing and the NCSC and the and the UK government, they're not sitting on their hands, they're getting ahead of it and they're looking to build up resilience and they're driving this act to effectively do that. So I think there's no question it's going to come in and it's a good thing that it's going to come in because it's all about making the UK more resilient to cybercrime. So where is it? Well in November 25, I think it passed Commons, it's been sitting now with the Lords and they're actively reviewing and we're aiming for Royal Assent to be passed somewhere towards the end of 2026. So once passed, I guess the important thing is what does that mean for businesses and I'm sure we'll unpack that more later, but it's probably a period of about 12 to 24 months until that fully comes into act. So that period of time will be absolutely critical for businesses to, I guess, get their ducks in a row and get everything moving in terms of compliance with that bill. Lynn: Yeah, and while you say twelve to twenty-four months on paper, that might seem like a long time, but we know how quickly time itself is moving, right? and I couldn't agree more that this is definitely a very great thing, especially, you know, if we go back to episode one with Mark O'Dell when we were talking about the current state of cyber security in the UK and the UK being in the top three most targeted countries in the world. You know, it's absolutely a no-brainer that this is absolutely going to happen. So, you know, still playing devil's advocate. advocates a little bit for the naysayers out there. Let's assume, right, that it does happen, which it will. At a very high level, Mark, what is the bill proposing in essence? mark: well at its core and it's a really it's about making the u k more resilient it's about helping the u k's critical services to be able to detect and at that it's a and defend itself against track from from from adversaries but what does that really mean in essence well probably that's that that's that's for for things i would say come from one is that it will insure that the business is a lot of businesses that are covered under the act within a 24-hour rule So and that's important. So when something hits when an instant hits they've got 24 hours to give a short statement of what that attack means and as now that also for the first time will include what you call Near-miss reporting so this is where the business may have been impacted by something that they manage to avert and prevent but It's important because it starts to paint a picture for the UK at a national level of what's going on in terms of attacks that the UK attack surface is facing. So that would be the first thing. The second is that the the bill will provide much clearer guidance on what good security looks like. What does good cyber look like? And that will largely be built on the NCSC cyber assessment framework. So again it will give more guidance. Three, importantly, it's gonna give the regulator teeth. And what do I mean by that? It's gonna give it fiduciary power to be able to fine. Now that's not obviously the idea, but with any of these, what we see in any business, is that often you need to, the penalties need to be there to, I guess, better incentivize some of the businesses to take part or to take it seriously. Now the fines are quite significant. I was reading, I think, you know, it can be up to a 17 million pound fine or 4 % of a business is turnover. And then for ongoing non-compliance there is the ability to fine up to £100,000 a day. So it's significant, significant money, absolutely. The Lynn: Yeah, my mind is blown. mark: last bit would be, and again a very good thing, but it's giving the government emergency powers of direction. if If we see on a national level that we're facing a critical threat, then the government and the NCSE can direct businesses to take the appropriate actions and security controls in place to get ahead of that threat. So again, a number of really sort of good initiatives that will strengthen the UK's ability to be more resilient in the future. Lynn: Yeah, yeah, great measures to take there. And I of course go back to the whopping figures that you have just quoted. You know, that can easily take the average UK S and B clean out of business, right? Especially if you run the risk of being fined on a daily basis. So that also of course highlights the importance of all of this. So, you know, who is likely to be impacted by it? mark: Yeah, that's really an interesting question because I think there's two camps. So the first is businesses like Babble. Yeah, it's what we call is that there's about a thousand that will be directly impacted. And that's mostly targeted operators of additions to essential services like energy, transport, health care that were already covered. It's looking at digital infrastructure providers. So things like online marketplaces that interact with other businesses, also MSPs. So again, businesses that provide IT management and support. And also there is this capsule called designated critical suppliers. So that could be third party vendors that are supplying critical components or items that are used by critical suppliers in the UK. So let's say providing a critical component that's going into the NHS healthcare. They would be manufacturing that. That would be a designated as a critical supplier. So those will be directly under the regulatory focus and and and censorship of the body But then there's a much broader Group and this is probably where the biggest impacts going to be going to be felt So if you if you look at the UK today, you've got about somewhere between four and a half five million SMBs in the UK So obviously a thousand that will be in addition directly impacted. It's not a huge amount. So what's the noise? Why why though? Why the worry? Well, the reality is that as part of this this bill for the first time what they're looking to do is really to drive better focus on supply chain So this means that any corporate will need to understand validate and assess They are they will need to assess their audit change to the people that are supplying them So this is often called the the supply chain or flow down trickle effect So this will be businesses that are directly censored that will be looking at their suppliers and auditing them Okay, so these businesses of which The government believes there will be about half a million affected in the UK, so 10 % of the SMB community. And their impact will not necessarily be regulatory, but it will be commercial. Because unless those businesses can demonstrate that they can pass those audits, then they very well lose business that they're already providing them as a supplier, or limit their ability to win new business. Lynn: Yeah, definitely a lot at stake there. And you know, what you said around supply chains diff definitely jumped out at me. So we'll unpack that in a second, right? But just to touch on, again, playing a little bit of devil's advocate here. So for a business that might be listening in on this that doesn't necessarily see themselves as critical, you know, a critical organization or maybe even not entirely affected by that supply chain triple trickle down effect, what should give them pause and really, you know get them to take this seriously. mark: Well, I think again, the critical will be, think it's really right to maybe put that aside. There will be a different process and a different way of managing that. And those businesses are probably largely already getting ahead of that. Certainly we are as a business in terms of getting the compliance in place, the monitoring and detecting capability, et cetera. So I think any business that the first thing is they really need to understand that their business split and where their money's coming from in terms of identifying where they may have impact. But what I would say is that there are statistics out there in the market that only 15 % of businesses in the UK currently review their supplier cyber risks, which means the vast majority, almost nine out of 10, are not doing that, which means that it's likely that half of these million SMBs in the UK have never really had to do that sort of contract compliance work that will be coming downstream from this business. So, and if they don't get ahead of that, then they will run the risk of potentially not being able to compete for business and tenders and certainly may even impact losing some of their business if they can't demonstrate the cyber resilience. So, I would say there was also some research that we did. recently, that actually showed that there is quite a significant difference between businesses that think they are ready and confident in preparing or managing an attack and those that are actually really geared up to do it. So 79 % of SMB leaders that were asked said that they could identify an attack, but when we did further, only around half of them said they had the relevant tools in place or the necessary tools in place to do that holistically. There is a question, Margaret, because businesses in the UK do really good things about building their resilience up. There is a question maybe if some of their confidence is little misplaced on their readiness to do it. And again, this is part of the reason why this resilience bill is coming into play. Lynn: Yeah, a lot of great points well made there and of course I just latched on to the research that we put out earlier this year. For those of you who might not be familiar with it, it's known as the Technology Performance Index. And we did a we did an episode with Mark O'Dell, Jeremy Langley unpacking the research, and we will actually have an upcoming episode that dives a little deeper into this false sense of confidence that the UK SMB leaders that we at least surveyed have when it comes comes to the cyber security posture because it largely ties into just looking at these cyber security tools as that silver bullet in a way, right? But as we've unpacked all throughout, you know, this podcast, the technology is outstanding. It's phenomenal, right? But it also takes people, processes, and playbooks to actually make this all come together. So those were really great points to make. So now going back to that earlier point you made around supply chains, right? So you've mentioned that this already has a real supply chain impact with that trickle down effect. So Mark, do you mind walking us through what that looks like? mark: Yeah, okay, so let's run it forward and let's say audits are starting to come, so that 85 % of businesses that aren't currently doing their audits are starting to have to do the audits because this bill is in place. So what does that really mean to people and businesses, SMBs, that are going to face that? Well, the first thing is they're going to have to sign up to or be able to demonstrate that they can provide the relevant information to comply with the 24 hour reporting rule. So they're going to need to have the right monitoring in place, the right detection in place to be able to check and notify within a time frame. Secondly, to do that, they're going to have to be able to evidence and audit that they have the right cyber controls in place. Now that could be things like multifactorial authentication in terms of how you connect or manage endpoints. could be endpoint management itself, encryption, having the right backups in place to deliver more resilience. All of those things will need be needed to show that you have the right controls to detect and the right facilities. place to be more resilient in how you deal with an attack. Thirdly, businesses are going to have to demonstrate that they are working to a compliance level. Lynn probably, I'm sure, in of the podcasts previously, things like Cyber Essentials or Cyber Essentials Plus, which seems better because it's third party validated, is critical. Some other businesses like ourselves, ISO 27001, these are all regulatory and compliance systems that are necessary to demonstrate that you're complying with them to show that the business has the right building blocks and the resilience in place. And also many businesses may start to ask for, and we certainly see this quite significantly in the US market, is things like cyber insurance and getting your cyber insurance in place. And that will be able to show that you've got the right financial capability to manage and the resiliency of your business to manage if they're in the worst situation, if there is an attack that can't be thwarted when it emerges. So all of those things will need to be, a business will need to be able to demonstrate and get there and I think you mentioned earlier, part of that also is being able to with that compliance is demonstrating that your staff are cyber aware. It's still a very large amount of attacks that are perpetrated through human error. So making sure that you've got the right cyber training and various things like that is still a critical necessity. Lynn: Definitely. I mean, just walking it back with regards to how humans are either the weakest entry points into the business or the strongest a business's strongest line of defense. It really ties nicely into episode three of this podcast where James Gaskell and I just unpack the human risk element when it comes to cyber security and how important you know cyber security awareness is and absolutely not taking treating it like a tick box exercise, if you will, but something else that you had also said you know tying it back into the one of the new requirements around that twenty-four hour reporting right and touching on monitoring and detecting and I couldn't help but think of our webinar that we actually had this morning, which was talking about managed detection and response. So for those of you who might be interested, I will pop a link to that in the description below for you to just understand what that looks like as well and you know what your options are. But you know, bringing it back to you know this UK resilience bill if a business needs To be ready to sign up to those indemnity clauses and prove their insurance, right? You mentioned cyber security insurance. What would that entail or include? mark: What is it changing things insurance businesses that were moving pieces and insurance companies changing constantly whether that's delivering changes to their premiums or indeed just not offering insurance in the first place and you know as I said that the the interest companies are brilliant at looking at risk and understanding how that how that works financially but what I would say is that I think businesses can expect insurance companies to become more prescriptive on what they're looking for. So certainly being able to, some of the things that we just talked about, Lynn, so being able to show that you've got the right compliance in place, that your people are trained, that you have done third party validation, things like cyber essentials, you've got that set up. that you have the right detection in place. So that means often that they will look for you to make sure that you've got 24 seven monitoring. so obviously something as you mentioned today with the with the webinar we had, which was great. think we had, you know, 200 people sign up to businesses sign up for that in the UK or close to and showing how how how sort of you know, of the moment that is. Also, though, being able to do things like making sure that if you do have an You can demonstrate your bounce back ability. So your resilience. Do you have an incident response? Capability do you have an insurance one man? Have you put backups to your systems? All of that stuff is critical and just really knowing how you act in a moment that you have an incident and being able to demonstrate that that capability You know, look all of that needs to be done and I do I'm quite conscious that sounds quite for a business that isn't At the cutting edge of that that can be quite scary But I suppose I bring it back to the original bit then which is you know this act is still not passed It will be it will be very likely passed soon, but you will have a period of gestation period of Maybe up to two years to get this stuff in place. So whilst there is a lot to do there are It's a well trodden path. There are people businesses like ours that can help on that journey And and cyber is fundamentally a journey, but it is one that you have to take seriously and again back to the very first start of this school, it's one that's just the right thing to do for businesses anyway, for them to be more resilient and cyber aware. Lynn: even as you were unpacking in one of the previous questions, you know, what it entails to be ready for this bill, essentially, I couldn't help but think about, you know, all of the letters in the hidden acronym, right? Right from human risk all the way to network and cloud security, covering all of those bases. So that is exactly why we're having these conversations right now, because as you said, there's that gestation period and there also people like You know, that are very close to what's happening as well and are there to help you, you know, navigate all of this. You definitely do not have to navigate this yourself. Obviously, there are a lot of things as you know Nikoo had explained in the previous episode about the fact that you do as a business still have that accountability for keeping your business safe, but you definitely do not have to do that alone and you can delegate a lot more than you may think that you cannot so that was excellent to make. So now we're just gonna switch gears and talk about you know what leaders should ask right now, you know, upon listening or watching this episode. So Mark, rather than waiting for that final implementation in 12 to 24 months, what should leadership teams be asking themselves today? mark: Okay, so yeah, good good. Well, I honestly genuinely believe that any business and any leader should be and my recommendation always be is is understand how How resilient you are? Yeah, what is your cyber maturity that regardless of any act or bill? It's just good business practice. So really truly understanding where you are on that journey. And as you said, you know, if you look at hidden, really is the business can be attacked from so many different areas. So understanding your resilience across that piece is critical. So one, understand where you are. Yeah. Don't stick your head in the sand. Be aware of where you are. Only then can you start to look at attacking it in the right way and building a plan either directly or with. or with partners to get ahead of that. to on t the other thing with trying to the the the bill itself is on the stand what your potential impact would be yeah so if you are not directly regulated from this which is a relatively small number across the the s and b community is likely to be you will in some way be indirectly impacted the trickle down effect as we called earlier and on that one what i would always recommend is understand whether the businesses in the revenue that you want driving, whether how much of that is likely coming from a critical business or a business that will be having to audit you in the future. If you know that, you can start to prepare and get ahead and understand the size of the potential risk or opportunity you may be facing. The third question is if you, and I think this is important as well, if you look at your own IT infrastructure and what you're doing and what you're providing, many businesses out there have been using MSPs or partners for very long time. And I think it's a right opportunity to just make sure when you're asking the questions, as I think, know, Lynn, you asked me earlier, what am I getting asked? Well, I'm getting asked as a CRO at Babble, you know, are we ready? Are we bill ready? And that is certainly something that any customer should be asking for their key suppliers. So looking at any of their infrastructure providers, digital providers, they should be making sure that they're asking the tough questions of them as well. Lynn: Yeah, definitely appreciate those points, especially the last one around having an MSP in place. It kind of ties to that point around looking at the tools as a silver bullet. Some companies are predisposed to think, Okay, I have an MSP, they're gonna take care of all of it. but that is something that you, as you mentioned, can't take for granted and something that you actually need to interrogate. So again, going back to the previous episode, you know, Nikoo walked through just a few questions that you can use. to you know ask your MSP directly to just make sure that they're covering all of the The basis and then adding, you know, Mark's advice to that as well, relating that back to how prepared they are for the bill in and of itself as well, right? So now this next question you have already answered arguably throughout this conversation, right? But I'll ask it anyway because there might be some people that aren't necessarily so close to cyber security. Yes, they might see the breach headlines and hear about the act in the paper. I mean, hear about it in the news and things like that, read the paper. But you know, why shouldn't businesses just treat this as a tick box exercise in your opinion? mark: Yeah, I think that I have, I've tried to answer that, again, I truly from, and again, maybe that's partly from the number of businesses I've worked with in my history within cyber security and technology. But I genuinely would counsel that any business leader should just take cyber and cyber security very seriously. It should be seen as a core mandate for their business. And not only to protect their revenue streams or their business, but also their customers, their employees. A report from Cyber Crime Magazine the other day showed that 60 % of SMBs questioned can out of business after a material cyber incident. breach and that's significant yeah that's something that we all need to take seriously but also I think there is a plus side of getting cyber ready and that is that consumers are starting to buy you know if you know that there is a risk or that one of the people that you're working with is not cyber ready is not taking those controls seriously they're not asking you to sign in a multiple factor MFA for example then it's likely they will start going because the consumer today is so much more cyber savvy than they were a few years ago. So I think just looking at being cyber secure, the risks are out there, the opportunities are out there, and I think just getting ahead of that is an absolute critical requirement for any business leader today. And I guess I'd leave it with one thing, if you go and leave your car in the car park, you're walking away from it, do you think, do you wait there and go, it's an expensive car, lock it or do you go back and check? And I think, you know, in very simple terms, cyber is not something that you leave to chance in today's business. The cyber there will be an attack at some point. So getting ahead of that and locking the doors is critical for any business leader. And then if nothing else, the Resilience Act will be and the Resilience Bill will be driving that and mandating that in the future. This is not going away. This is something that's only going to increase. Lynn: Yeah, as it should, you know. that would have actually been the perfect, you know, way to end this conversation. But I do just have one more question for you, which is if a business does nothing else before this legislation lands, what's the one conversation that they should have internally this quarter? mark: Okay, that's a good question. So I think I'm a firm believer that cyber doesn't just sit within an IT department. You know, it equally is not just the CEO's problem. It's the business as a whole. So I think the one thing is to understand that in the view that this is coming and just generally that cyber and being cyber security is a good idea for any business anyway. I would really counsel that that you get aligned as a leadership team and across the business on why being secure matters and why this bill matters. And then from that, you can start to build a Plan on what needs to be done by when to get ahead of it And again, there's no need to panic this act hasn't passed yet But when it does you'll still have a 12 to 24 month period and again, there's lots of people out there You can help you on that journey But I definitely being aligned and not putting your head in the sand is a critical next step. I'd say Lynn: Mm. Definitely. so without further ado, this has been a great conversation. we've unpacked quite a bit, and of course, there are a lot more nuances to this bill in and of itself. So there are additional sources that you can check out in the description below to learn a little bit more and get into the weeds of the legislation. but that brings us to the end of this conversation for now. So thank you so so much. much again Mark. It has been an absolute pleasure having you on the show. mark: No, thank you for having me today. Thank you, Lynn. Lynn: Awesome. That's a wrap on today's episode of the Hidden Podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. and until next time, don't let your risks stay hidden.