Michael Lawrence, Director of Marketing at Dahua Technology, looks at recent changes in Government policy and how they can affect the wider security market

Just days into his premiership, Andy Burnham’s decision to abolish the Department of Science, Innovation and Technology (DSIT) was a dramatic signal that his government is prepared to shake up the UK’s science and technology policy.

Set up in 2023, DSIT was tasked with securing the UK’s role as a ‘global science and technology superpower by 2030’. In its stead, DSIT’s responsibilities have been dispersed to two other Whitehall departments – the Department for Business, Innovation, Science and Trade (BIST) and the Department for Culture, Media and Sport (DCMS) – in addition to a new AI Taskforce, housed under the Cabinet Office.

Burnham’s move has posed a pertinent question for the security industry: What would we like to see under the government’s new tech policy?

In my role as Director of Marketing at Dahua Technology, I travel the length and breadth of the UK, speaking to installers, suppliers and end-users in our field.

We live in an interconnected global economy, where our supply chains and business operations are closely interwoven with our neighbours in Europe and further afield.

It’s no surprise therefore that one of the concerns I most frequently hear relates to uncertainty over differing cybersecurity regulations across markets.

And that’s why Burnham’s Whitehall restructuring can offer a great opportunity. Firstly, the move presents a clear opportunity for the UK to seize the momentum of the AI industry and empower its tech sector for further growth.

Burnham’s appointment of Kanishka Narayan as Minister for Artificial Intelligence, sitting jointly in the Cabinet Office and BIST, is a clear recognition of the technology’s transformative potential, and of the importance of joined-up, cross-departmental policy making.

But equally importantly, the redistribution of core DSIT functions to the business secretary should be viewed as an opportunity to align the UK’s tech, business and trade policies, rather than a de-prioritisation of the UK’s ambition to become a science and technology superpower.

Burnham’s move undoubtedly recognises that today’s cybersecurity policy is closely intertwined with business and trade, enabling the UK to move further and faster to align with key global economies.

The Cyber Security and Resilience Bill remains the UK’s core legislative reform

The Cyber Security and Resilience Bill will likely remain the centrepiece of British cybersecurity reform.

It establishes a number of recommendations to update the UK’s 2018 Network and Information Systems (NIS) cybersecurity regulations, a framework that was principally sound but struggled to keep pace with the accelerating frequency and sophistication of cyberattacks.

In response to the changing digital landscape, the Bill looked to widen the range of organisations in scope and give regulators stronger powers to enforce it. It will also bring the UK into far closer alignment with the EU’s NIS2 Directive introduced in 2022. 

The Bill’s passage through Parliament will be welcome news to companies that span British and European markets, lowering the cost of compliance between the two. But it also introduces requirements that companies must prepare for in advance if they are to thrive in the new regulatory environment.

Succeeding in the UK’s new cybersecurity environment

The key to success under the Bill will undoubtedly be to implement cybersecurity best practices throughout a company’s product chain in advance of its passage. 

At Dahua Technology, we are proud to present a strong track record of cybersecurity certification.

Most recently, Dahua received IEC 62443-4-1 certification for secure development lifecycle processes, part of the globally recognised series of IEC 62443 standards adopted by the International Electrotechnical commission (IEC).

This certification covers core company processes, including risk assessment, security verification and vulnerability management, and establishes a Secure Development Lifecycle (SDL) framework that is closely aligned with current and proposed UK and EU legislation.

This builds on our ISO 37301 and ISO/IEC 27001 certifications – covering compliance management systems and information security management systems respectively – which not only prove to regulators the company’s adoption of the highest standards in cybersecurity but also provide peace of mind to customers of Dahua’s commitment to excellence and improvement across its product chain.

Dahua is also proud to have achieved Common Criteria EAL3+ certification (ISO/IEC 15408) and CSA STAR certification. Common Criteria is the internationally recognised framework for evaluating the security of IT products; CSA STAR, run by the Cloud Security Alliance, assesses the security of cloud services.

We are committed to meeting leading international cybersecurity standards. We believe these achievements reflect that commitment and our ongoing work to strengthen our security and compliance measures across our own products and throughout the supply chain.

Aside from cybersecurity certification, an equally important key in Dahua’s cybersecurity chain is our Product Security Incident Response Team (PSIRT), who continuously monitor global cybersecurity threats and provide 24/7 emergency response services to safeguard our customers.

PSIRT is also responsible for receiving, handling and publicly disclosing security vulnerabilities related to our products and solutions. We encourage reports from users, partners and others across the supply chain, so that potential threats are identified as quickly as possible.

The PSIRT response process is built on recognised international standards. Dahua PSIRT is an authorised CVE Numbering Authority, which means it can assign globally recognised identifiers to vulnerabilities in its own products.

It manages them in line with ISO/IEC 30111 and ISO/IEC 29147, with each vulnerability being scored using the industry standard CVSSv3 framework. As a result, transparency is enhanced and customers are left confident knowing our team has an established vulnerability management system in place.

As the UK advances the Cyber Security and Resilience Bill, timely cybersecurity disclosure will be essential to any business exposed to regular cyber threats. The Bill proposes a 24-hour initial notification window, following the discovery of a cyberattack, which must be followed by a full report within 72 hours.

The UK’s National Cyber Security Centre will now be informed of incidents at the same time as regulators, enabling both bodies to rapidly support affected organisations and identify systemic vulnerabilities.

It will be crucial, therefore, for businesses to implement the infrastructure required for accurate and timely cybersecurity disclosure in advance of the Bill’s passage; and Dahua’s experienced PSIRT team will enable the company to transition seamlessly into the new regulatory environment.

Cybersecurity certification is the key to getting ahead

The abolition of the Department for Science, Innovation and Trade was certainly a shake up to the Whitehall structure, but beyond the headlines, Burnham’s reforms promise new opportunities for the security sector.

Crucially, they signal the government’s willingness to align cybersecurity regulations with its business and trade strategy to capitalise on the booming AI market and enable British companies to flourish on the global market.

But if businesses are to succeed, getting ahead of regulatory changes through proactive cybersecurity certification is crucial to implement the structures required for compliance in advance of the Bill’s passage. Here at Dahua, our commitment to excellence in compliance remains steadfast, enabling us to thrive through changing regulatory environments.