Purpose
To assess whether proposals for stronger cyber competence standards alongside the Cyber Security and Resilience (Network and Information Systems) Bill could affect Northstar Group plc.
What has changed
Baroness Northover raised the issue during Lords consideration of the Bill on 7 September 2026. The source identifies a proposal concerning stronger cyber competence standards, potentially including expectations for regulated organisations to use appropriately qualified cyber professionals.
The source currently available is a Hansard contribution record. It does not include the amendment wording, the Government’s response, whether the amendment was pressed to a decision, or the subsequent procedural position. The substance and legal effect of the proposal therefore remain unconfirmed.
Why this matters to Northstar
Northstar is a UK-wide infrastructure and consumer services business with a large frontline workforce and projects dependent on timely planning and consenting decisions. If any of its activities fall within the Bill’s regulated sectors, new competence expectations could affect:
- the roles responsible for cyber security, incident response, operational technology and resilience;
- qualification, accreditation or continuing professional development requirements;
- recruitment and retention of specialist cyber personnel;
- training expectations for operational and frontline teams with security responsibilities;
- oversight of relevant suppliers and outsourced service providers; and
- evidence needed to demonstrate compliance to regulators or competent authorities.
This could become a skills and compliance issue rather than a purely technical policy change. The scale and timing of any impact cannot yet be assessed.
Current assessment
- Relevance: high enough to continue active work, given the link to the live Bill and the potential effect on regulated operators.
- Confidence: the Lords contribution is confirmed, but the precise proposal and its status are not.
- Northstar exposure: not yet confirmed.
- Position: no approved organisational position has been recorded.
- External engagement: none prepared or authorised at this stage.
Evidence required
- The amendment text and debate outcome, including any Government response and relevant statements about implementation.
- Confirmation from Legal and Cyber Security of potentially in-scope Northstar activities, entities, systems, suppliers and existing NIS obligations.
- An Operations and HR baseline covering relevant cyber roles, qualifications, training, vacancies and capability gaps.
- Any existing internal policy, assurance or audit findings relevant to cyber competence and resilience.
Recommended internal sequence
First, verify the amendment and Bill timetable. In parallel, Legal and Cyber Security should map regulatory scope and current obligations, while Operations and HR establish the workforce baseline. Public Affairs can then assess whether the proposal warrants internal advocacy, stakeholder engagement or simply continued monitoring.
Decision point
No policy position should be agreed until the proposal’s text and status, Northstar’s regulatory exposure and the current skills baseline are confirmed.