The UK government is proposing legal changes to block companies from buying products from high-risk suppliers, following a cyber attack by an Iran-linked hacking group that shut down a small gas plant. Amendments to the Cyber Security and Resilience Bill would let ministers require critical sectors — energy, healthcare, telecoms — to implement phased removal of certain vendors or face bans on acquiring their technology. Baroness Liz Lloyd, cyber security minister, said the powers enable action "before a threat materialises, not just after the damage is done." The National Cyber Security Centre warned firms to strengthen defenses, noting supply chains are a "soft underbelly" for hackers.

Energy firms, heavily reliant on Chinese-made solar panels, batteries and electric vehicles — China supplies over 90% of global solar panels — warn the rules could raise costs and delay projects. The bill also mandates regulated companies to report significant attacks to the NCSC within 24 hours and submit incident reports within 72 hours, with fines for non-compliance on data protection and staff training frameworks.