UK Cyber Bill Would Let Ministers Secretly Block Risky Tech Suppliers

The UK government has proposed amendments to its Cyber Security and Resilience Bill that would give ministers new powers to restrict, condition, phase out, or ban technology suppliers used by operators of essential and critical services on national security grounds. The measures would apply beyond telecoms to sectors including energy, water, transport, healthcare, managed service providers, data centers, and digital infrastructure, and are intended to reduce the risk of hostile-state-linked vendors being used for spying, sabotage, or disruption.

Under the proposed vendor-related direction regime, the government could intervene when organizations seek to buy from suppliers judged to pose critical risks, require extra security controls, or order withdrawal of existing technology. The framework would also allow ministers to act without publicly naming the vendor and, in some cases, without directly notifying the supplier, while restricting recipients and consulted parties from disclosing the order. The package also includes cyber-safe procurement guidance, a voluntary referral process for uncertain buyers, public notice that a direction was issued, and annual reporting to Parliament ahead of House of Lords scrutiny.