Supplementary written evidence submitted by Rt Hon Michael Ellis QC MP, HM Paymaster General

 

Thank you for your letter of 14 March, requesting further information following my previous submission of evidence to the Joint Committee on the National Security Strategy.

 

In my capacity as Minister responsible for resilience and security, I am committed to tackling and improving the chronic risk posed by Climate Change. This remains a top priority for the Government. Following your request, I have provided a written response to your additional questions in Annex A.

 

I look forward to continuing to work with you and the wider committee to achieve our shared goals.

 

4 April 2022

 

ANNEX A: WRITTEN EVIDENCE SUBMISSION - ADDITIONAL QUESTIONS

 

The submission states that the CNI Knowledge Base will allow risk owners to “view UK CNI on a map or as a network graph, with interdependencies mapped across it”.

  1. What level of access to the Knowledge Base will be offered to infrastructure operators and regulators?
  2. How will the Government use the intelligence generated by the Knowledge Base to reduce infrastructure vulnerabilities? What will be the policy mechanisms for achieving this?
  3. Will the Knowledge Base also map interdependencies between CNI from a cyber security perspective?
  4. When exactly in 2022 is the Knowledge Base expected to ‘go live’?

1.      For national security purposes, access to the CNI Knowledge Base is being restricted to CNI sector lead departments, the Cabinet Office and key agencies, i.e. the Centre for the Protection of National Infrastructure (CPNI) and the National Cyber Security Centre (NCSC). The Government will take opening access to Regulators (as government bodies) into consideration, and will carefully review the implications of different access levels if that decision is made.

2.      The Government works closely with operators and regulators to reduce infrastructure vulnerabilities. The CNI Knowledge Base will enable a greater understanding of the breadth of CNI systems across the UK, identifying interdependencies of varying nature (including cyber security) between sectors and a greater ability to identify the vulnerabilities themselves, e.g. over-reliance on a single supplier by multiple sectors.

3.      The roll-out of the CNI Knowledge Base to CNI sector lead department users is planned for summer 2022, and work with CNI sector lead departments and the Cabinet Office continues to agree the order in which individual sectors are onboarded.

The submission states that “senior cross-government groups focussed on resilience, infrastructure and CNI continue to convene to support the implementation of cross-government policy on the security and resilience of the UK’s critical infrastructure”. Please may you provide a list of these groups for the Committee’s reference, along with their terms of reference and recent meeting dates?

4.      National Security Ministers (NSM) (Resilience): NSM (Resilience) is a sub-committee of the National Security Council (NSC), supporting a strategic and closely coordinated cross-government approach to risks and opportunities facing the UK, specifically focused on resilience. There is an equivalent officials group (NSM(O) Resilience) chaired by the Deputy National Security Advisor. Meetings are held ad hoc and as required, if Cabinet collective agreement is needed for example, with regular slots held in the wider NSM calendar for the NSM (Resilience) every 6 months. The last NSM(O) Resilience meeting was held on 3 November 2021. 

5.      Resilience Directors General group: The Resilience Directors General group was established in Spring 2021. The group brings together resilience officials from across Whitehall and the Devolved Administrations to discuss how resilience can be collaboratively improved across the UK. The group focuses on all elements of the risk cycle and considers security threats, civil contingencies, hazards and resilience. The Resilience Directors General group provides oversight, assurance and strategic direction for the security and resilience of the UK. Where collective agreement or Ministerial decisions are required, the group escalates to the NSC, NSM, or relevant Cabinet committee. Meetings are typically held monthly, with the last Resilience Directors General taking place on 9 February 2022. A UK-Devolved Administrations Directors General Resilience Quad forum will operate in parallel to the Resilience Directors General group, offering an opportunity to focus on issues specific to the Devolved Administrations.

6.      These meetings are supported by regular working level meetings attended by representatives from the 13 sectors together with colleagues from the Centre for the Protection of National Infrastructure (CPNI) and the National Cyber Security Centre (NCSC) to discuss cross-cutting policies affecting CNI.

The submission also notes that “Each sector has its own fora and methods of engagement with industry to ensure cohesive threat and hazard preparedness”.

  1. Which of the nine departments listed in the submission hosts a forum or working group for operators and/or regulators to consider and drive progress in climate adaptation, and/or resilience to climate change?
  2. What (specifically) are the mechanisms or fora by which those nine departments collaborate on interdependencies between different types of infrastructure?
  3. How do these groups share information about CNI resilience and adaptation with Local Resilience Forums, and vice versa?

7.      Government departments responsible for the UK’s CNI work closely with owners and operators to ensure their sector’s resilience to both threats and hazards.

8.      Government departments do not host fora specifically focused on the resilience and security implications of climate adaptation on CNI; however, sector lead departments do host or attend sector-specific or cross-sector fora with owners, operators, trade bodies and regulators focused on ensuring resilience to a wide range of risks, which may include responding to risks related to the impacts of climate change (e.g. flooding) and climate adaptation.[1]

9.      Government departments responsible for CNI sectors collaborate on infrastructure interdependencies at the working level through numerous cross-sector and industry fora, including at a sector-wide level through the Infrastructure Resilience and Security Working Group, as well as through ad hoc bilateral engagement. Departments also work together to assess and understand interdependencies between their CNI sectors through the Criticalities process, the outputs of which are collated into the CNI Knowledge Base tool.

10.  Lead Government Departments are responsible for ensuring the security and resilience of their CNI sectors, and therefore as a matter of course do not directly share CNI information with Local Resilience Forums (LRFs) for national security reasons. LRFs are made up of Category 1 and 2 responders, with duties set out under the Civil Contingencies Act, 2004. Some of these Category 1 and 2 responders work closely with or in some cases are part of CNI sectors and therefore constituent parts of LRF partnerships will have access to CNI information in their area as appropriate. In addition, Category 1 and 2 responders work with CNI owners and operators on resilience at the local levels, with information-sharing agreements in place in compliance with the duties set out under the Civil Contingencies Act 2004.

On the issue of global supply chains, the submission simply states that “The Government is committed to building strong supply chains, resilient to both  short-term shocks and long-term challenges”.

  1. What actions is the Government taking to build more resilient supply chains, both in relation to climate change and more broadly?
  2. Are there any key sectors on which Government activity is focused?

11.  Work to increase supply chain resilience to both short and longer-term issues is an increasing focus for the Government, reflecting the experiences of Brexit, the Covid-19 pandemic and now the conflict in Ukraine.  Our supply chains have demonstrated that they are already remarkably resilient, but it is also now well-understood that we cannot take them for granted.

12.  As a result of engagement across government and industry on short-term supply chain issues, the Prime Minister's Supply Chains Advisor, Sir Dave Lewis, set out recommendations to the Government on both immediate improvements and potential long-term changes to UK supply chains and supply chains policy which included:

    1. Ensuring that government continues to build and embed departmental capability and collaboration on supply chains policy;
    2. Building stronger capability to horizon scan, spot risks early, and collate and utilise data to determine and solve supply chains data;
    3. Working with industry to consider how best to optimise existing infrastructure capacity;
    4. Improving cross-modal connectivity;
    5. Ensuring the UK has the right tools in place to support resilience and capacity of supply chains;
    6. Considering how to improve the recruitment and retention of HGV drivers and other staff critical to supply chains.

13.  In response to Sir Dave Lewis' recommendations, the Government is considering options for how to ensure that departmental capability and collaboration on supply chain policy continues to be built and embedded. The Government is also looking at conducting more proactive supply chain horizon scanning by gathering, collating and sharing data. Recent government interventions to improve supply chain resilience included:

    1. 32 actions to address the shortage of heavy goods vehicle (HGV) drivers in the UK, including increasing HGV driver Covid-19 testing capacity by 90% above the pre-pandemic baseline and investing £32.5 million to improve facilities across the country;
    2. Announcing the Seasonal Agricultural Workers scheme for 2022-24 to provide long term stability to the sector;
    3. Introducing temporary visas to bolster the UK’s food supply chains;
    4. Easing competition law for the delivery of fuel to forecourts.

14.  The Government is also working to strengthen the long-term resilience of the UK’s critical global non-food supply chains, improving the UK’s national security and economic resilience through international trade. Specifically, it focuses on strengthening the Government’s understanding and monitoring of the UK's critical supply chains, designing policy and guiding actions to strengthen the long-term resilience of supply chains (including in the Integrated Review and Plan for Growth), and creating and supporting international efforts to strengthen the resilience of critical supply chains – both bilaterally and through multilateral forums including the G7.

15.  The Government is developing the third National Adaptation Programme (NAP3) to address the impact that climate change will have on the UK, highlighted by the Climate Change Committee (CCC) in their 2021 Climate Change Risk Assessment (CCRA3). Among the 61 risks identified in the CCRA3 are risks to businesses from supply chain disruption and risks to international trade routes. Each risk will have a senior responsible owner who will work across government to develop an Adaptation Pathway aimed at mitigating the respective risk.

The submission notes that the devolved administrations hold responsibility for CNI sectors under devolution settlements. Can you please provide a list of the sectors for which resilience responsibilities are devolved?

16.  Responsibility for the management of the security and resilience of CNI sectors varies between devolved administrations according to the details of their devolution agreements. The devolved administrations are responsible for devolved CNI sectors in Scotland, Wales and Northern Ireland. The UK government is responsible for the security and resilience of CNI assets of reserved sectors located in Scotland, Wales and Northern Ireland.

17.  The Scottish Government is responsible for chemicals, the emergency services (ambulance, fire & rescue, police, but excluding coastguard), food, health, local and Scottish government, transport (road and bridges within Scotland, but not cross-border, and excluding aviation, maritime and rail), and water.

18.  The Welsh Government is responsible for the emergency services (ambulance, fire & rescue, but excluding coast guard and police), food, health, local and Welsh government, transport (road infrastructure only, and excluding aviation, maritime and rail), and water (excluding cross-border water infrastructure).

19.  In Northern Ireland the NIO leads on national security issues relating to CNI and has ownership of the CNI list for the region whilst the individual devolved departments are responsible for all other CNI resilience matters within their sectoral responsibilities. These are the emergency services (ambulance, fire & rescue, police), energy (excluding nuclear), food, health, local and Northern Ireland government, transport (with exceptions), and water.  The Northern Ireland Executive can legislate on the following reserved sectors with approval from the Secretary of State: finance (services and markets), communications (broadcasting, telecoms and postal service), and transport (civil aviation).

Do you consider yourself to be the lead Government Minister for CNI resilience? If so, what formal interactions on this topic do you have with the Minister for Agri-Innovation and Climate Adaptation at Defra (via ministerial working groups, for example)?

20.  As Minister for the Cabinet Office and Paymaster General, I am the Lead Government Minister for resilience and security, and accordingly for CNI resilience; however, each sector has a responsible minister that remains accountable for the security and resilience of their respective sector.

21.  To date, I have had no formal engagement with the Minister for Agri-Innovation and Climate Adaptation at Defra with regards to CNI and climate adaptation.

Are there any formal or informal links between the National Security Risk Assessment (NSRA) and Climate Change Risk Assessment (CCRA3) processes?

22.  The NSRA and the CCRA3 are complementary but separate processes that are linked informally.

23.  The NSRA does not include every possible risk that faces the UK, instead focusing on those that drive significant acute consequences, such as disruption to key health and transport services and environmental damage, and that meet predetermined thresholds for inclusion in the document.

24.  These thresholds cover the types of risks meeting the pre-defined criteria of a civil emergency as defined in the Civil Contingencies Act 2004 or pose a serious threat to national security. Within the NSRA, risk owners also address the likely impact of long-term risks such as climate change on their risk in the next 5-10 years. For example, a number of natural hazard related risks encapsulate the potential impacts of climate change on the reasonable worst case scenarios related to weather. The CCRA3 is one source of evidence used to inform these assessments.

The Office of Rail and Road has advised us that the Department for Transport (DfT) gives them a monitoring remit for National Highways, in contrast to the ORR’s more intensive regulatory remit for Network Rail.

  1. What additional regulatory requirements are placed on National Highways by the Department of Transport, in relation to climate adaptation and resilience to extreme weather events?
  2. The ORR told us that they would be supportive of the DfT broadening their remit in relation to National Highways – is there any reason why they should not be given a proper regulatory remit, including in relation to climate adaptation?

25.  The Office for Rail and Road (ORR) is responsible for monitoring National Highways’ management of the strategic road network – the motorways and main ‘A’ roads in England.

26.  National Highways’ licence, issued by the Secretary of State for Transport, states that it should “adapt its network to operate in a changing climate, including assessing, managing and mitigating the potential risks posed by climate change to the operation, maintenance and improvement of the network.”

27.  National Highways is required under the Infrastructure Act 2015 to have regard to this guidance.

28.  DfT cannot provide comment on the broadening of the ORR’s remit at this time, and such a change would require careful consideration.

­­­­

 

Letter from the Chair of the Committee to Rt Hon Michael Ellis QC MP, HM Paymaster General, 14 March 2022

Thank you for submitting evidence on the Government’s behalf for JCNSS’s inquiry into CNI and climate adaptation. I am writing with a number of additional questions, either generated by your submission or to address points that have arisen during the course of our inquiry to date.

 

  1. The submission state that the CNI Knowledge Base will allow risk owners to “view UK CNI on a map or as a network graph, with interdependencies mapped across it”.
    1. What level of access to the Knowledge Base will be offered to infrastructure operators and regulators?
    2. How will the Government use the intelligence generated by the Knowledge Base to reduce infrastructure vulnerabilities? What will be the policy mechanisms for achieving this?
    3. Will the Knowledge Base also map interdependencies between CNI from a cyber security perspective?
    4. When exactly in 2022 is the Knowledge Base expected to ‘go live’?

 

  1. The submission states that “senior cross-government groups focussed on resilience, infrastructure and CNI continue to convene to support the implementation of cross-government policy on the security and resilience of the UK’s critical infrastructure”. Please may you provide a list of these groups for the Committee’s reference, along with their terms of reference and recent meeting dates?

 

  1. The submission also notes that “Each sector has its own fora and methods of engagement with industry to ensure cohesive threat and hazard preparedness”.
    1. Which of the nine departments listed in the submission hosts a forum or working group for operators and/or regulators to consider and drive progress in climate adaptation, and/or resilience to climate change?
    2. What (specifically) are the mechanisms or fora by which those nine departments collaborate on interdependencies between different types of infrastructure?
    3. How do these groups share information about CNI resilience and adaptation with Local Resilience Forums, and vice versa?

 

  1. On the issue of global supply chains, the submission simply states that “The Government is committed to building strong supply chains, resilient to both short-term shocks and long-term challenges”.
  1. What actions is the Government taking to build more resilient supply chains, both in relation to climate change and more broadly?
  2. Are there any key sectors on which Government activity is focused?

 

  1. The submission notes that the devolved administrations hold responsibility for CNI sectors under devolution settlements. Can you please provide a list of the sectors for which resilience responsibilities are devolved?

 

  1. Do you consider yourself to be the lead Government Minister for CNI resilience? If so, what formal interactions on this topic do you have with the Minister for Agri-Innovation and Climate Adaptation at Defra (via ministerial working groups, for example)?

 

  1. Are there any formal or informal links between the National Security Risk Assessment (NSRA) and Climate Change Risk Assessment (CCRA) processes?

 

  1. The Office of Rail and Road has advised us that the Department for Transport (DfT) gives them a monitoring remit for National Highways, in contrast to the ORR’s more intensive regulatory remit for Network Rail.
    1. What additional regulatory requirements are placed on National Highways by the Department of Transport, in relation to climate adaptation and resilience to extreme weather events?
    2. The ORR told us that they would be supportive of the DfT broadening their remit in relation to National Highways – is there any reason why they should not be given a proper regulatory remit, including in relation to climate adaptation?

 

We will be inviting Government Ministers to give oral evidence for this inquiry in due course. It would be helpful to receive your response in advance of any evidence session, by Thursday 14 April.

 

Dame Margaret Beckett DBE MP

 

14 March 2022

 

 

 

 

 

 

 


[1] Examples of these include the Infrastructure Operators Adaptation Forum hosted by the Environment Agency, the Transport Adaptation Steering Group, the Food Supply Resilience Working Group, or the Climate Change Resilience Working Group led by the Energy Networks Association.