UK Cyber Security and Resilience Bill: What It Means and How to Prepare

Last updated: 22 October 2026

Quick answer: The Cyber Security and Resilience (Network and Information Systems) Bill would update the UK’s NIS Regulations 2018. As introduced, it brings medium and large managed service providers, data centres, large load controllers and designated critical suppliers into scope. It also requires an initial incident notification within 24 hours and a full report within 72 hours, widens what counts as a reportable incident, and raises maximum fines. It is still a Bill before Parliament, and most of its duties will take effect through secondary legislation after Royal Assent.

The UK has regulated the cyber security of essential services since the Network and Information Systems Regulations 2018 came into force. Those regulations were based on the original EU NIS Directive. After Brexit the EU replaced that directive with NIS2, and the UK government decided to update its own regime separately.

The Cyber Security and Resilience Bill is that update. It was introduced to Parliament on 12 November 2025. After its Commons stages it moved to the House of Lords in June 2026. It is not yet law, and the details may still change through amendments and the secondary legislation that follows.

The Bill still deserves attention now. Organisations that will be newly in scope, especially managed service providers (MSPs) and data centre operators, need time to build governance, incident response and supplier assurance that a regulator can examine. This guide explains what the Bill would change, who it would cover, how it relates to the NCSC Cyber Assessment Framework and Cyber Essentials, and how to prepare.

What is the UK Cyber Security and Resilience Bill?

It is a government Bill that amends and extends the Network and Information Systems Regulations 2018. It is not a new standalone regime. The basic NIS model stays in place: regulated entities must manage the security risks to their network and information systems, report significant incidents and cooperate with their regulator.

What changes is the reach and strength of that model. According to the government’s Bill factsheets, the main themes are:

• Wider scope: data centres, medium and large managed service providers, large load controllers and critical suppliers.
• Faster, broader incident reporting: a two-stage 24-hour and 72-hour process, covering incidents that could cause significant impact as well as those that already have.
• Stronger regulators: higher maximum penalties, cost recovery from regulated entities and better information sharing.
• Future-proofing: powers for the Secretary of State to update the framework through secondary legislation, set strategic priorities for regulators and issue directions on national security grounds.

Much of the detail, including thresholds for “significant” incidents, the definition of turnover for fines and the timing of new duties, is left to secondary legislation. The government has said it will consult on implementation and give affected organisations an adjustment period.

Where is the Bill in Parliament?

The Bill was introduced in the House of Commons on 12 November 2025 and went through committee stage in early 2026. It was introduced to the House of Lords in June 2026. Check the Parliament bill page for the current stage before relying on any date or figure. Lords amendments could still change the text, and nothing in this guide should be read as a final legal requirement.

Who would the Bill cover?

The Bill keeps the existing NIS categories and adds new ones. The table summarises the position as introduced.

Managed service providers

For many readers this is the biggest change. MSPs often hold privileged access to many customer networks at once, so an attack on one provider can spread to all of them. The factsheet defines a managed service as the ongoing management of a customer’s IT systems under contract, such as support, monitoring or administration. Small and micro enterprises are exempt. Software vendors that only sell products, consultancies that do not manage IT on an ongoing basis, operational technology providers and one-off installers are also outside the definition.

An in-scope RMSP would have to register with the Information Commission, appoint a UK representative if based overseas, take appropriate and proportionate security measures for the systems it uses to deliver managed services, report significant incidents and tell affected customers. If you run an MSP, a vCISO practice or a managed security service, our GRC platform for MSPs page explains how Enactia supports multi-client compliance work.

Data centres

Data centres above the thresholds would become operators of essential services regulated by Ofcom. They would have to manage risks to their systems, take steps to prevent and limit incidents so services keep running, report significant incidents and certain near-misses, notify Ofcom within three months of designation and answer information notices.

Designated critical suppliers

A regulator could designate a supplier as critical if it supplies an OES, RDSP or RMSP directly, depends on network and information systems to do so, and an incident affecting it could have a significant impact on the economy or everyday life. The regulator must consider whether other suppliers could step in and whether other regimes already address the risk, and must consult the supplier first. Small and micro businesses can be designated. Designated suppliers would face requirements no stricter than those on the entities they supply, and they could appeal to the First-tier Tribunal.

What are the main proposed measures?

Incident reporting within 24 and 72 hours

As introduced, the Bill sets a two-stage process:

1. Initial notification within 24 hours of becoming aware of an incident. This is a short notice to the regulator, with the NCSC informed at the same time. It covers who you are, which service is affected and brief details.
2. Full report within 72 hours, with as much further detail as is known at that point.

RDSPs, RMSPs and data centre operators would also have to tell customers who are likely to have been adversely affected, explaining why, so they can take steps to protect themselves.

The bigger change may be what counts as reportable. Under the 2018 regulations, the focus is on incidents that actually disrupted a service. The Bill extends reporting to incidents that have adversely affected the operation or security of relevant systems and whose impact has been, is or is likely to be significant. That means some intrusions, such as an attacker found inside a network before any outage, could become reportable. The factors for judging significance will be set in secondary legislation.

The timeline will be familiar to anyone working with EU rules. NIS2 uses a 24-hour early warning and a 72-hour notification, explained in our NIS2 incident reporting guide. UK GDPR personal data breach reporting to the regulator also runs on a 72-hour clock. One incident could therefore trigger several reports to different bodies, with different content.

Regulator powers, penalties and cost recovery

The current NIS penalty structure has three bands, with a top fine of £17 million. The Bill proposes two simpler bands:

The government says not every breach will lead to a fine. Regulators will consider remedial steps and any pattern of non-compliance, and penalties can be appealed to the First-tier Tribunal. How turnover is defined, including when group turnover counts, will be set in secondary legislation.

Regulators would also be able to recover the full cost of their NIS functions from regulated entities through published charging schemes. They would have to consult first, could not make a profit and would have to report how the money was used. Information-sharing provisions would make it easier for regulators, the NCSC and other bodies to share relevant information.

Secretary of State powers

The Bill gives the government three kinds of lever:

• Future-proofing: secondary legislation to bring new sectors into scope or update security requirements, without a new Act of Parliament.
• Statement of strategic priorities: priority outcomes that NIS regulators must seek to achieve, to make regulation more consistent across sectors.
• Powers of direction: the ability to direct regulators or regulated entities to take targeted, proportionate action where there is a threat to national security.

For compliance teams, the practical point is that the regime will keep changing after Royal Assent. Plan for regular updates rather than a single, final set of requirements.

How does the Bill relate to the NCSC CAF and Cyber Essentials?

The Bill sets legal duties. It does not prescribe a control framework. In practice, two NCSC frameworks are likely to shape how organisations meet those duties.

NCSC Cyber Assessment Framework (CAF)

The Cyber Assessment Framework is outcome-based. It is organised around four objectives: managing security risk, protecting against cyber attack, detecting cyber security events and minimising the impact of incidents. Many NIS regulators already use it to assess operators of essential services, and the government’s Bill materials point to CAF version 4.0 as guidance. The Bill does not make the CAF mandatory, but organisations entering the regime should expect regulators to use CAF-style outcomes when judging whether measures are “appropriate and proportionate”. Our NCSC CAF guide covers the objectives and how to collect evidence against them.

Cyber Essentials

Cyber Essentials is a certification scheme for basic technical controls: firewalls, secure configuration, user access control, malware protection and security update management. It is a useful baseline, and it is often asked for in public sector and supply chain contracts. On its own it will not show compliance with NIS duties, which also cover governance, risk management, detection, incident response and supply chain security. Treat it as a floor rather than a target. Our comparison of Cyber Essentials and ISO 27001 explains where each fits.

If you already hold ISO 27001 certification, much of your information security management system (ISMS) will carry over: risk assessment, asset inventory, supplier management, incident management and management review. Map those controls to CAF outcomes rather than starting again.

How should organisations prepare for the Cyber Security and Resilience Bill?

You do not need to wait for secondary legislation to start. The steps below are useful under any final version of the Bill, and most of them also support NIS2, UK GDPR and customer assurance requests.

1. Confirm scope. Work out whether each legal entity in your group is, or could become, an OES, RDSP, RMSP, in-scope data centre or likely critical supplier. For MSPs, check your size against the small and micro enterprise test and list the services that count as ongoing IT management. Record your reasoning, and review it when the thresholds are confirmed.
2. Identify your regulator. Know who will supervise you: the Information Commission, Ofcom or a sector regulator. Follow their consultations and guidance.
3. Set up governance. Give a named board member accountability for cyber resilience, define reporting lines, and agree a risk appetite. The government’s Cyber Governance Code of Practice is a useful reference for board responsibilities. Keep minutes and decisions as evidence.
4. Map your assets and dependencies. Build an inventory of the systems, data and suppliers behind each in-scope service. You cannot report “the affected service” within 24 hours if you have not defined your services and what they depend on.
5. Run a gap assessment. Assess your current controls against CAF outcomes, or against ISO 27001 controls mapped to the CAF, and prioritise gaps by risk.
6. Rebuild incident response around 24 and 72 hours. Define who decides whether an incident is reportable, using the broader “likely significant impact” test. Prepare notification templates and keep regulator and NCSC contact details current. Also plan how you would identify and notify affected customers, and how UK GDPR, NIS2 or contractual notifications fit alongside. Test the process with a tabletop exercise.
7. Strengthen supply chain assurance. Rank suppliers by criticality, assess the most important ones, and review contract clauses on security, incident notification and audit rights. Our supply chain security checklist and vendor risk assessment questionnaire are a good starting point, and most of the questions apply equally under the UK regime.
8. Organise your evidence. Regulators assess what you can show. Keep policies, risk assessments, test results, training records, supplier assessments and incident logs in one place, with owners and review dates.
9. Budget for regulation. Allow for registration, possible regulator charges under cost recovery, and the staff time needed to answer information requests.

In practice: the 24-hour clock fails most often at the decision step, not the writing step. Teams lose hours debating whether an incident is reportable. A short, pre-agreed set of significance criteria and a named decision-maker, with a deputy, make the biggest difference.

What MSPs should do first

MSPs face a double effect. They may be regulated as RMSPs themselves, and they will also field more security questions from regulated customers. Start by checking your scope and registration readiness. Then review privileged access to client environments and your own incident notification process. Finally, prepare a clear account of your security controls that you can share with customers. Many MSPs also see an opportunity to offer compliance services to their clients; our guide to packaging NIS2 services for SMEs shows how that model works in the EU.

How can GRC software help?

The Bill does not require any particular tool. Spreadsheets can work for a small organisation with one service, but they become hard to manage once regulators expect a joined-up view of assets, risks, suppliers, incidents and evidence across several frameworks.

When you compare platforms, look for:

• An incident register with impact assessment, deadline tracking and report preparation.
• Third-party management with reusable assessment templates and a record of supplier certifications.
• An asset inventory linked to business services, suppliers and risks.
• Cross-framework mapping, so evidence collected once can support ISO 27001, Cyber Essentials, UK GDPR and NIS requirements.
• A central evidence repository with owners, review dates and an audit trail.

Enactia covers these areas through its incident and data breach management, vendor and third-party management, asset, risk and policy modules, and the Compliance Universe for mapping controls across frameworks including ISO 27001, Cyber Essentials, UK GDPR, NIST CSF and the NIS Directive. For a wider view of UK requirements and how to choose a platform, see our guide to GRC software for UK organisations.

Frequently asked questions

Is the Cyber Security and Resilience Bill law yet?
No. It was introduced to Parliament in November 2025 and moved to the House of Lords in June 2026. Even after Royal Assent, most new duties, including incident reporting changes and the inclusion of data centres and MSPs, will start only when secondary legislation is made. Check the Parliament bill page for the current stage.

Does the Bill replace the NIS Regulations 2018?
No. It amends and extends them. The NIS Regulations remain the basis of the regime, with new categories of regulated entity, stronger reporting duties, higher penalties and new powers for regulators and the Secretary of State.

Are all managed service providers in scope?
No. As introduced, only medium and large providers of ongoing, contracted IT management services in the UK are in scope. Small and micro enterprises are exempt, although a regulator could still designate one as a critical supplier. Pure software resellers, one-off installers, consultancies without ongoing management and operational technology providers are excluded.

What are the incident reporting deadlines?
As introduced, an initial notification to the regulator, with the NCSC informed at the same time, within 24 hours of becoming aware of a significant incident, followed by a full report within 72 hours. RDSPs, RMSPs and data centres must also inform customers likely to be affected. These rules take effect through secondary legislation.

What are the maximum fines?
As introduced, up to £17 million or 4% of worldwide turnover, whichever is higher, for more serious breaches such as failures in security or incident reporting duties. Less serious breaches carry up to £10 million or 2% of worldwide turnover, whichever is higher. These figures could change before the Bill becomes law.

Is Cyber Essentials enough to comply?
Unlikely. Cyber Essentials covers basic technical controls. NIS duties are broader and include governance, risk management, detection, incident response and supply chain security, which regulators commonly assess against the NCSC CAF.

Preparing for the UK’s updated NIS regime

The Cyber Security and Resilience Bill widens the UK’s NIS regime to MSPs, data centres and critical suppliers. It tightens incident reporting to a 24-hour and 72-hour cycle and gives regulators stronger powers. The final details depend on Parliament and secondary legislation. Scoping, governance, incident response, supplier assurance and well-organised evidence will be needed under any version, and they also support your other UK and EU obligations. Enactia’s AI-powered GRC platform brings these workstreams together in one place.

To discuss your readiness, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.