blog.gov.je
Matt Palmer, Director of Jersey Cyber Security Centre, explains why the Government of Jersey is proposing a new Cyber Security law and how you can contribute.
In the last 15 years, Island organisations have adopted many new technologies and systems. In doing so, they’ve opened up new opportunities that have benefitted Jersey’s economy and society.
But alongside these new opportunities, there are also new risks. Cyber criminals continually find new ways to extract sensitive data and personal information. And like any other jurisdiction, Jersey is at risk of being a target.
However, the fact that we are an independent jurisdiction means that we have a unique mix of risks. We manage our own power and water supplies, healthcare, and other vital infrastructure. Our economy is built on professional industries whose international reputation is – in part – maintained by their ability to handle sensitive data and information securely.
This means that successful cyber attacks could have significant impacts across the Island.
The Government of Jersey established the Jersey Cyber Security Centre (JCSC) to respond to these risks. Since 2021, we’ve worked to prevent, protect, and defend the Island from cyberattacks, as part of the Department for the Economy.
Cyber security is an ever-changing area. New vulnerabilities continue to appear, and malicious actors will find ways to exploit them. Whilst it is never possible to eliminate all risks, Jersey organisations need to be vigilant and take steps to prepare. To do this, they need guidance on the standards they should meet. This includes guidance on how and when to share information about any serious cyber incidents.
The draft Cyber Security (Jersey) Law is a good step in introducing this structure: it supports the Island’s overall cyber resilience by introducing support and providing clear expectations, but seeks to do so without creating any unnecessary burden on industry.
Firstly, it establishes JCSC as an operationally independent, grant-funded organisation accountable to the Minister for Sustainable Economic Development, and defines what we are here to do. With the right legal structure and a clear basis for our work, we’ll be able to work closely and confidentially with organisations in the event of a cyber incident. It will also allow us to provide independent advice to Government and other local bodies, where appropriate.
Secondly, the draft Law sets out how we should be governed. It establishes a Technical Advisory Council (TAC) which will provide expert advice and guidance to support our decision-making. The Law also requires us to produce an Annual Report and regular Strategic Plan, to ensure transparency around our work.
Finally, the Law will introduce new reporting standards for some organisations, defined as Operators of Essential Services (OES). Basically, these are any organisations whose operations are critical for the welfare of islanders, for our economy, or our reputation.
OES will need to take appropriate steps to improve and secure their cybersecurity. They’ll also be required to notify JCSC and their customers if they experience a significant cyber incident.
To make sure we take full account of industry and public feedback, the Government of Jersey and JCSC are running three consultation periods.
The first consultation on the principles for the draft Law took place last year. The results of this consultation were then used in the drafting of the Law. A two-week consultation on the content of the Law itself now starts on Tuesday 5 March and runs until Tuesday 19 March, with input sought specifically on the OES requirements.
After this the law will be amended by the Government to take account of feedback, and lodged with the States. Finally, further consultation will take place on implementation before the Law comes into effect.
To support the consultation, JCSC is holding briefing sessions for organisations and individuals between 6 – 8 March, and is also offering 1:1 briefings with OES providers the following week. You can sign up for a briefing via JCSC’s Eventbrite page, or respond directly to the survey via the Government of Jersey website.