Member

I am not entirely sure whether the amendments in the name of the noble Lord, Lord Ashcombe, were spoken to, but, as a precautionary measure, I resist the suggestion to extend the timeframe for submitting the full incident notification. His amendments would require the full notification to be submitted within 30 days of a regulated entity becoming aware of an incident, rather than the current deadline of 72 hours. This change would mean that regulated entities would provide no information to their regulators following the initial notification issued within 24 hours, which could create a worrying gap between the regulator’s and the NCSC’s awareness of the incident. Maintaining the rhythm set out in the Bill would mitigate that risk.