UK government exempting itself from flagship cyber law inspires little confidence

The article critiques the UK’s proposed Cyber Security and Resilience (CSR) Bill for excluding central and local government, contrasting its narrower scope with the EU’s NIS2, and highlighting concerns raised by MPs and experts that voluntary measures like the Government Cyber Action Plan lack enforceable obligations. Citing a critical NAO report on government systems, it argues that omitting the public sector undermines confidence and invites scrutiny, while suggesting iterative, targeted legislation as a potential path forward.