Member

99: After Clause 42, insert the following new Clause— “Cyber security competence: functions of the UK Cyber Security Council(1) The UK Cyber Security Council is to exercise the functions described in subsection (2) and is accountable to the Secretary of State for the exercise of those functions.(2) The functions are—(a) to validate and accredit professional qualifications, standards and titles for cyber security professionals employed by regulated persons,(b) to monitor the supply of, and demand for, qualified cyber security professionals across the sectors regulated under this Act and the NIS Regulations, and(c) to audit whether, and to what extent, regulated persons employ or have access to appropriately certified cyber security professionals.(3) For the purposes of this section, “regulated person” has the same meaning as in Chapter 3 (see section 30).(4) A regulatory authority (as defined in section 24) must have regard to the information and standards provided by the Council under this section when exercising its functions.(5) The Secretary of State must by regulations made by statutory instrument make further provision about the exercise of the Council’s functions under this section, including provision about its accountability for the exercise of the functions described in subsection (2).(6) A statutory instrument containing regulations under this section may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament.”Member’s explanatory statement This new clause would give the UK Cyber Security Council statutory functions to validate qualifications, to monitor the supply of and demand for cyber security professionals in the areas covered by the Bill, and to audit whether regulated organisations employ certified professionals—a “competence mandate” for the regime.