The new Cyber Security Act covers about 8,000 companies and organisations, but self-assessment remains sufficient without external oversight. The account argued that this approach should change, citing risks ranging from hacked refrigeration systems to empty supermarket shelves.