Lord Markham (Con)

I add my thanks to the noble Baroness, Lady Kidron, and other noble Lords for trying to make sense of what we all agree is a very difficult area. We are trying to come to a definition of high-risk areas. As we have heard in the examples today, you cannot limit it to size or certain criteria, but we all recognise that you need some sort of risk-based approach for who we really need to be watching out for, for want of a better phrase. In some ways, I come back to the suggestion from my noble friend Lord Camrose. In its severity scale, the Cyber Monitoring Centre has tried to set up such a mechanism. It looks at having a separate grid system which considers, on the one hand, the financial, pound-note impact and, on the other hand, the impact on members of the population. It is a really difficult exercise to define exactly what should and should not be in it, but in using a scale such as this and asking companies or entities to assess themselves, if they come up with a “0” or “1”, then it is less of a concern and, if they come up with a “3” or “4”, it is more of a concern. I accept that some of them will game it and might not treat it honestly, but a lot of them might not. To go to my noble friend’s example of that one small data centre, probably only the centre itself knew at that time that it was pivotal to so many other people. The centre having to make an assessment on where it comes on this severity scale, involving at least the executive team, and having a non-executive board asking, “Are you sure you’re only a 1 or 2? Surely, from what you were telling me the other day about everything we look after, it means we should be 3 or 4” is important because we start to get a criterion that we can look at in all this. Trying to define it by ruling in different entities according to size and certain criteria will be well-nigh impossible. So I welcome the Minister’s thoughts on whether we can take a system that seems to be working, to a degree, today and think about it between now and Report stage in terms of whether that is a relevant criterion we could use.