NCSC's tenth-anniversary review calls the government's new cyber security bill 'comprehensive, flexible and enforceable.' The bill still has two drafting defects this site found, and its companion national plan missed a government deadline five months ago.
Estimated reading time: 7 minutes
In short. The NCSC's 84-page Annual Review 2026, "The State of the Cyber Nation", published 3 November to mark the agency's tenth year [[1]], states that the Cyber Security and Resilience Bill "will introduce a more comprehensive, flexible and enforceable regulatory framework" [[2]], page 54. It does not mention that this site already found, in the Bill's own text and the government's own memorandum, an undefined trigger for converting a voluntary vendor-risk referral scheme into a compulsory one [[3]], and a cross-referencing error that cites subsections listing no activities at all for a reasons duty Lords peers forced into the Bill by a division [[4]]. Both still stand: the Bill remains at Consideration of Lords amendments, with no date set, as of 8 November [[5]]. Separately, the review describes "the forthcoming National Cyber Action Plan (NCAP)" [[2]], page 67, five months after a government release said NCAP would be "published this summer" [[6]], and without saying which department now owns it, since the department that published its predecessor plan and made that promise was dissolved in a machinery-of-government change in late July [[8]][[9]]. Two documented mistakes: four stars.
Ten years ago this month, the National Cyber Security Centre opened as the UK's technical authority on cyber security, part of GCHQ. Its Annual Review marking that anniversary is a flagship document: a foreword from the CEO, a message from the Director of GCHQ, a ministerial foreword from the Minister for Security, and 84 pages assessing a decade of threats and the decade ahead. Two of its claims rest on the state of government policy as the review itself describes it. Both claims can be checked against documents already in the public record, several of them the Bill's own text and this site's own prior work.
The claims, tested
| The review's own words | What the public record shows | Verdict |
|---|---|---|
| The Cyber Security and Resilience Bill "reflects the growing importance of cyber resilience to the UK's security, prosperity and public confidence" and "will introduce a more comprehensive, flexible and enforceable regulatory framework, with important new sectors brought into scope, new national security powers to respond to crises" [[2]], page 54 | The Bill's own vendor risk management clause lets the Secretary of State convert a voluntary referral scheme into a compulsory one for energy, water, transport, health and digital infrastructure operators, triggered by "if the risk profile changes", a phrase the government's own Supplementary Delegated Powers Memorandum never defines, measures or dates [[3]]. Separately, a reasons duty forced into the Bill by a 202 to 155 Lords vote cites two subsections that list no activities at all, while the correct list sits two paragraphs away in a subsection the same clause cites correctly elsewhere [[4]] | "Enforceable" is the word used for a Bill containing, in its own clauses, a compulsion power with an undefined trigger and a transparency duty that currently cannot fire |
| The National Detect Strategy "is a key part of the Government Cyber Action Plan (GCAP) and the forthcoming National Cyber Action Plan (NCAP)" [[2]], page 67 | A government release dated 22 April 2026 said the Cyber Resilience Pledge "will form part of the National Cyber Action Plan to be published this summer" [[6]]. A further release on 7 July 2026, launching the Pledge, said only that it "comes ahead of" NCAP, again without a date [[7]]. The Department for Science, Innovation and Technology, which published GCAP on 6 January 2026 and made the "this summer" promise, had its functions redistributed in a machinery-of-government change the government's own fact sheet dates to 22 July 2026 [[8]][[9]] | "Forthcoming", unqualified, on 3 November, is the same word used when the plan was five months overdue against the government's own stated season, and the review does not say which department is now responsible for delivering it |
A regulatory framework called enforceable, without the parts that are not yet enforceable
The review's language on the Bill is unhedged: "more comprehensive, flexible and enforceable" sits alongside "important new sectors brought into scope" and "new national security powers to respond to crises" [[2]], page 54. Nothing in that passage is factually wrong about what the Bill contains. The vendor risk management power is real, and so is the national security direction power. What the passage omits is that two parts of the same Bill, read directly, do not yet work as described.
The vendor risk framework creates a two-stage power: a voluntary referral route now, and a separate power for the Secretary of State to make that referral compulsory later [[3]]. The government's own Supplementary Delegated Powers Memorandum says the switch happens "if the risk profile changes", without saying what would count as a changed risk profile, who assesses it, or on what cycle [[3]]. A framework with an enforcement mechanism that nobody outside government can test is not yet the "enforceable" framework the review describes; it is a framework that will become enforceable once a minister decides a test nobody has defined has been met.
The second defect sits in a different part of the Bill. Lord Birt's amendment, forced through the Lords 202 to 155 against the government's wishes, requires ministers to publicly explain any sector or technology, including cloud services and frontier AI, left out of the UK's cyber security regime [[4]]. The paragraph creating that duty cites two subsections that list no activities at all; the subsection that does list them sits two paragraphs earlier in the same clause [[4]]. The Lords' own Deputy Speaker read out three other cross-referencing corrections to the same amendment before the vote. This one was not among them [[4]]. As drafted, nothing on the list the amendment was meant to police can trigger the duty it creates.
Both findings were published before the review: 4 November for the vendor risk power, 5 November for the reasons duty [[3]][[4]]. The review was published 3 November, so it could not have referenced either piece directly. But the underlying defects sit in the Bill's own text and the government's own memorandum, not in this site's analysis of them, and both were available to be read before the review went to print. The Bill has not moved since: it remains at Consideration of Lords amendments, with no sitting date yet scheduled, when checked directly against the Parliament Bills API on 8 November [[5]].
A plan called forthcoming, five months after its own deadline
The second claim is smaller in scope but cleaner to check, because the government gave itself a specific target and missed it without saying so again. On 22 April 2026, a Home Office and Cabinet Office release announcing an industry "call to action" on AI and cyber defence said the Cyber Resilience Pledge "will form part of the National Cyber Action Plan to be published this summer" [[6]]. Summer 2026 has been and gone. The Pledge itself launched on 7 July, with the accompanying release saying only that its launch "comes ahead of" NCAP, dropping the seasonal commitment without replacing it with a firmer one [[7]].
NCAP is positioned throughout the review as the successor to the Government Cyber Action Plan, published 6 January 2026 by the then Department for Science, Innovation and Technology, backed by more than £210 million [[2]], page 7, [[8]]. DSIT does not exist in that form any longer. The government's own Machinery of Government Changes fact sheet, published 22 July 2026, confirms that DSIT's functions were redistributed, without naming a successor department for each function or mentioning cyber security specifically [[9]]. The review repeats "forthcoming" on page 67 without updating the season, without a replacement date, and without saying which department has inherited the job of publishing it [[2]].
Credit where due
The review does not oversell the threat picture, which is its harder job. It is candid that AI "did not create these cyber security weaknesses; it revealed them" [[2]], page 5, and that the NCSC's own incident data shows 88 per cent of large-organisation incidents still come from four familiar routes: exploited public-facing applications, phishing, misuse of valid accounts and exploited remote services [[2]], page 15. The "7 things we learned" section is blunt that sophistication is rarely needed to gain initial access [[2]], page 28. None of that is the part being checked here. The two claims tested in this piece concern government policy delivery, not threat assessment, and the review's caution on the threat side does not extend to the same caution about the Bill or the plan.
The mistakes, counted
The Bill called "enforceable" without disclosing an undefined compulsion trigger (1). The vendor risk management clause's switch from voluntary to mandatory referral is triggered by "the risk profile changes", a phrase the government's own memorandum never defines, measures or dates [[3]]. The review's "enforceable" does not qualify this.
A reasons duty's drafting error left unmentioned (2). The Lords-forced transparency duty on excluded sectors and technologies cites subsections listing no activities at all, making it currently untriggerable as drafted [[4]]. The review's "important new sectors brought into scope" claim does not address a duty meant to police exactly that scope.
A third thread, the National Cyber Action Plan's missed "this summer" target and its orphaned departmental ownership, is documented in this piece but not counted separately here: it concerns a plan still unpublished rather than a defect in a document already in force, and the review's single word, "forthcoming", is accurate as far as it goes. It is included because the pattern, an optimistic framing that omits a specific, checkable gap, repeats across both claims.
The star score counts two documented mistakes: the Bill's undefined vendor-risk compulsion trigger, and the drafting error that leaves the Lords-forced reasons duty unable to fire, both omitted from the review's "comprehensive, flexible and enforceable" framing. Two falls in the 1 to 3 band: four stars; the bands are on the ratings page. The National Cyber Action Plan's missed "this summer" target is reported but not counted as a separate mistake, since it concerns a plan not yet published rather than a defect in a published document. This piece makes no finding about the conduct of any named individual beyond what the cited documents themselves state. All sources were fetched directly on 8 November 2026 and returned HTTP 200; the Annual Review PDF was checked with a full-text extraction of all 84 pages, and the Bill's current parliamentary stage was re-verified directly against the Parliament Bills API on the same day.
Sources
- NCSC Annual Review 2026: The State of the Cyber Nation, National Cyber Security Centre, collection page, published 3 November 2026.
- NCSC Annual Review 2026 (PDF), National Cyber Security Centre, 84 pages, version 1.0, 3 November 2026.
- A new power in Britain's cyber security bill lets ministers force energy, water and NHS suppliers to report vendor risks. It stays voluntary until the risk profile changes, a test the government never defines or dates., trackedchanges.co.uk, 4 November 2026.
- Peers forced ministers to explain why they leave new technologies out of the UK's cyber security regime. The clause creating that duty names the wrong subsections, so nothing on its list can ever trigger one., trackedchanges.co.uk, 5 November 2026.
- Bill stages, UK Parliament Bills API, Cyber Security and Resilience (Network and Information Systems) Bill, checked 8 November 2026: current stage Consideration of Lords amendments, no date scheduled.
- Call to action for AI companies to work with UK Government on national cyber defence, GOV.UK, 22 April 2026.
- Businesses across Britain sign up to Cyber Resilience Pledge as ministers urge firms to strengthen cyber defences, GOV.UK, 7 July 2026.
- Government Cyber Action Plan, GOV.UK, Department for Science, Innovation and Technology, 6 January 2026.
- Machinery of Government changes: Fact Sheet, GOV.UK, 22 July 2026.