The UK government's recent decision to exempt itself from its flagship Cyber Security and Resilience (CSR) Bill has sparked significant controversy and concern. This exemption, which applies to both central and local governments, comes at a time when cyber incidents have become increasingly common, with the National Cyber Security Centre (NCSC) reporting that 40 percent of attacks they managed between September 2020 and August 2021 targeted the public sector. Critics argue that this move undermines the effectiveness of the CSR Bill and raises questions about the government's commitment to cybersecurity.

Sir Oliver Dowden, former digital secretary, has urged the Labour government to reconsider this stance, emphasizing the need for stringent requirements on the public sector to ensure ministers prioritize cybersecurity. The CSR Bill aims to refresh outdated NIS 2018 regulations and bring managed service providers and datacenters into scope, but its exclusion of public authorities contrasts sharply with the broader scope of the EU's NIS2. This decision highlights the ongoing challenge of balancing cybersecurity needs with political considerations, as the government faces scrutiny over its ability to protect critical systems from cyber threats.