UK Government Moves to Cut High-Risk Tech Suppliers Out of Critical Infrastructure
Late additions to a new cybersecurity law would give ministers the power to remove or restrict technology providers judged to pose a national security risk, as attacks on supply chains grow more frequent.
Key points
- The UK government is adding new powers to the Cyber Security and Resilience Bill that would let ministers block or restrict high-risk technology suppliers.
- The changes target supply chain risk, where an attacker breaks into a major software or hardware provider to reach dozens of its customers at once.
- Critical infrastructure, meaning services like power grids, water systems and financial networks, is the focus of the new rules.
- The amendments were introduced late in the Bill's progress, suggesting urgency on the government's part.
- No specific supplier has been named publicly under the new powers.
The UK government is tightening who can sell technology to the country's most sensitive sectors. Late amendments added to the Cyber Security and Resilience Bill would hand ministers direct authority to bar or limit technology providers deemed too risky inside critical infrastructure. SecurityWeek first reported the changes. We first covered the Bill on 2 September.
Why does a software supplier matter to national security?
Supply chain attacks are the reason. When state-backed hackers want to reach hundreds of targets at once, they often go after a shared supplier first. Break into the software company, and you quietly inherit access to every organisation running that software.
The 2020 SolarWinds attack showed exactly how damaging this can be. Hackers attributed with medium confidence to a Russian state-linked group tracked as APT29 slipped malicious code into a routine software update. Thousands of organisations, including US government departments, downloaded it without knowing. That single breach cascaded across government and industry, and the UK recorded affected organisations of its own.
What does the Bill actually do?
The Cyber Security and Resilience Bill is the UK's main vehicle for updating national cyber rules. The amendments go further than the original draft by giving ministers a specific mechanism to act against suppliers, not just set standards for the organisations buying from them.
In plain terms: if a technology company is judged to carry unacceptable risk, because of its ownership structure or its conduct, ministers could order critical infrastructure operators to stop using it or impose strict conditions on how they do. Governments in the UK and the European Union have already moved against specific vendors on security grounds in recent years, so a formal legal power to act faster is a logical next step.
No supplier has been named publicly yet.
Should businesses or members of the public be concerned?
For most people, the direct impact will be invisible. Critical infrastructure operators bear the burden of auditing their supply chains and, where required, switching suppliers. That's expensive, slow work.
What matters to ordinary people is the underlying problem. A successful attack on a hospital's software supplier, or on systems running an energy network, can knock out services everyone depends on. These rules are an attempt to reduce that risk before an incident happens rather than after.
Organisations in regulated sectors should start mapping which technology suppliers could fall under the new rules, and what alternatives exist. Waiting for a minister's order is the harder path.
The detail to watch is how 'unacceptable risk' gets defined. That standard will determine whether these powers stay narrowly targeted or become a broader lever for procurement politics.
