Member

The second question is, what is the coverage? Is it essentially the suppliers in the world of cyber and digital activity or does it have to go wider? I have actually argued publicly for the regulation to go wider, because it is not satisfactory that when we get something as damaging as JLR, we have to have a public bailout. There is real danger to the economy, and I do not dispute that. Should it be the same as the kind of regulation applied to the direct suppliers—to the industry that supports the security of the country? There, I do not have a firm answer, but it seems to be an area where there ought to be discussion as to how far we take these regulatory powers. I am not someone who says that it is enough to go to the board and tell them to do a proper job. Most boards at the moment have a half-hearted and rather uninformed approach to cyber regulation and not enough real expertise.