British organisations could face fines of up to £17m, or 4% of global turnover, if they fail to take measures to prevent cyber-attacks that could result in major disruption to services such as transport, health or electricity networks.
But the proposals, which are being considered as part of a government consultation launched on Tuesday, say that financial penalties will be used as a “last resort” and not applied if organisations facing an attack can prove they assessed the risks adequately.
The move comes after the NHS became the highest-profile victim of a global ransomware attack, which resulted in operations being cancelled, ambulances being diverted and patient records being made unavailable.
The coordinated attack that infected a large number of computers across the health service was linked to WannaCry malicious software.
The issue came to the fore again after a major IT failure at British Airways left 75,000 passengers stranded and cost the airline £80m – although the company blamed a power supply issue rather than a cyber-attack.
The consultation will also focus on system failures, with requirements for companies to show what action they are taking to reduce the risks.
The digital and culture minister, Matt Hancock, said: “We want the UK to be the safest place in the world to live and be online, with our essential services and infrastructure prepared for the increasing risk of cyber-attack and more resilient against other threats such as power failures and environmental hazards.”
The consultation is on the Network and Information Systems directive to be implemented from May 2018, which is part of a £1.9bn national cyber-security strategy.
The Department for Digital, Culture, Media and Sport said it also wanted to see action to detect attacks, develop security monitoring and raise staff awareness, as well as ensuring incidents were reported immediately and that systems were in place for recovery. Workshops will be held where organisations can give feedback.
Ciaran Martin, the chief executive of the National Cyber Security Centre, said organisations needed to do more to increase cyber security.
“The NCSC is committed to making the UK the safest place in the world to live and do business online, but we can’t do this alone,” he said. “Everyone has a part to play and that’s why since our launch we have been offering organisations expert advice on our website and the government’s Cyber Essentials Scheme.”
The penalties proposed for flaws in network and information systems are similar to those proposed for data protection.
