Loading story…
The UK government has proposed amendments to its Cyber Security and Resilience Bill that would give ministers new powers to restrict, condition, phase out, or ban technology suppliers used by operators of essential and critical services on national security grounds. The measures would apply beyond telecoms to sectors including energy, water, transport, healthcare, managed service providers, data centers, and digital infrastructure, and are intended to reduce the risk of hostile-state-linked vendors being used for spying, sabotage, or disruption.
Under the proposed vendor-related direction regime, the government could intervene when organizations seek to buy from suppliers judged to pose critical risks, require extra security controls, or order withdrawal of existing technology. The framework would also allow ministers to act without publicly naming the vendor and, in some cases, without directly notifying the supplier, while restricting recipients and consulted parties from disclosing the order. The package also includes cyber-safe procurement guidance, a voluntary referral process for uncertain buyers, public notice that a direction was issued, and annual reporting to Parliament ahead of House of Lords scrutiny.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
The UK government laid amendments to the Cyber Security and Resilience Bill before Parliament, proposing new powers to restrict, direct, or ban procurement from technology suppliers deemed national security risks in critical sectors. The measures include binding directions, cyber-safe procurement guidance, and a vendor-risk assessment process for essential service providers.
The proposed amendments are set to be considered during House of Lords committee stage scrutiny in September. This marks the next formal legislative step for the proposed vendor-restriction powers.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourceitpro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
House of Lords peers proposed amendments to the UK Cyber Security and Resilience Bill that would make senior executives personally civilly liable for serious cybersecurity failures. The government rejected the measure, citing proposed penalties of up to **£17 million or 4% of annual turnover** and forthcoming board-governance requirements. Peers also warned that the bill's 24-hour incident-notification and 72-hour detailed-reporting deadlines could drive defensive over-reporting, while the government said the measures are needed to modernize the NIS Regulations 2018 and enable NCSC response. Liberal Democrat peer Lord Tim Clement-Jones also sought emergency powers for the government to deactivate dangerous AI systems and, in national-security emergencies, shut down data centers. He framed the AI “kill switch” as a last-resort control against autonomous systems compromising critical national infrastructure, including misuse by state-backed actors or ransomware groups. Industry voices supported emergency controls in principle but cautioned that the UK's dependence on foreign technology suppliers would limit their practical effectiveness without greater sovereign technology capacity and procurement reform.
Sep 10, 2026
The European Commission is pursuing revisions to the EU Cybersecurity Act to strengthen **union-level supply-chain risk management** for critical IT and telecom infrastructure, including the ability to impose targeted mitigations such as restrictions or bans on components from **“high-risk suppliers.”** Reporting indicates the proposal could effectively force member states to remove non-compliant equipment within a relatively short window—potentially **as little as three years**—as part of a broader effort to counter increasingly sophisticated hybrid threats to European infrastructure. The initiative is widely viewed as an attempt to harmonize and accelerate national actions that have been uneven across the bloc, amid long-running concerns about reliance on vendors such as **Huawei** and **ZTE** in 5G and other network deployments. The Commission’s approach emphasizes coordinated risk assessments and common rules for supplier trust decisions, reflecting ongoing debate over whether certain third-country suppliers could be compelled—via domestic legal obligations—to support state espionage or disruption operations, despite vendor denials of wrongdoing.
Jun 29, 2026
The European Commission unveiled a revised **EU Cybersecurity Act** proposal that would allow the bloc to identify and potentially exclude **“high-risk” suppliers**—including those deemed vulnerable to *third-country influence*—from critical digital infrastructure across **18 essential sectors**. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and **geopolitical** risk-management issue. Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around **network equipment** and connected energy technologies such as **solar inverters** that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand **ENISA’s** mandate, including closer operational cooperation with national authorities to help counter threats such as **ransomware**, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Jun 29, 2026