The UK Cyber Security and Resilience Bill: Who It Covers and What Changes

The Cyber Security and Resilience Bill is the UK government’s update to the Network and Information Systems (NIS) Regulations 2018, the law that sets cyber security and incident reporting duties for essential services and some digital services. It brings medium and large managed service providers (MSPs), larger data centres, large load controllers and designated critical suppliers into scope. It adds a 24-hour initial incident notification and raises maximum fines to £17 million or 4% of worldwide turnover, whichever is higher. As of 13 October 2026 it has passed the House of Commons and is in the House of Lords, so it is not yet law.

This guide is a plain-English summary, not legal advice.

What is the Cyber Security and Resilience Bill?

It is a Department for Science, Innovation and Technology (DSIT) bill, formally titled the Cyber Security and Resilience (Network and Information Systems) Bill. It was announced in the King’s Speech in July 2024, set out in a policy statement in April 2025 and introduced to Parliament on 12 November 2025.

The bill amends the NIS Regulations 2018 rather than replacing them. The government’s factsheets on gov.uk group it into three pillars:

• Expanded scope: data centres, MSPs, large load controllers and designated critical suppliers.
• Effective regulators: faster incident reporting, a statement of strategic priorities for regulators, cost recovery, clearer information sharing and simpler penalty bands with higher maximums.
• Enabling resilience: powers to update the regime by secondary legislation and to issue directions in response to national security threats.

When will the Cyber Security and Resilience Bill become law?

Not yet. Its Lords report stage is scheduled for 26 October 2026, and most duties will start only when later regulations bring them into force. The stages so far, from the bill’s record on the UK Parliament website:

Lords third reading, any exchange of amendments and Royal Assent follow. Even then, the government’s summary factsheet shows most duties starting later:

• On Royal Assent: the powers to update the regime by secondary legislation.
• Two months later: the statement of strategic priorities and information sharing.
• By commencement regulations: the duties for data centres, MSPs, large load controllers and critical suppliers, the new incident reporting rules, cost recovery and the powers of direction.

The government plans to consult on the detail and has promised a business adjustment period before new duties apply. We update this page at each stage.

Who comes into scope under the bill?

The bill keeps everyone already covered by the NIS Regulations and adds four new groups:

Does the bill apply to managed service providers?

Yes, if you are medium or large and provide managed services in the UK, whether or not you are based here. A managed service means ongoing management of a customer’s IT systems under contract, through support, monitoring or administration, with access to systems the customer relies on. The government’s examples in scope include remote network, backup and security monitoring, managed firewalls and intrusion detection, and ongoing management of a customer’s cloud. Firms that only install systems, sell software or give non-IT advice are out of scope.

In-scope MSPs will have to register with the Information Commission (the ICO) within three months of commencement, manage the risks to the systems they use to deliver services, report significant incidents and tell customers likely to be affected. Overseas MSPs will need a UK representative. Small and micro MSPs are exempt from these core duties, but a regulator can still designate one as a critical supplier.

What is a designated critical supplier?

A supplier whose failure could disrupt an essential or digital service. A regulator can designate one only if it supplies an operator of essential services, digital service provider or managed service provider directly, relies on network and information systems to do so, and an incident could disrupt that service in a way likely to significantly affect the UK economy or daily life. The regulator must also consider whether the supply could realistically come from elsewhere. Suppliers must be consulted first and can appeal to the First-tier Tribunal.

What changes for incident reporting?

Reporting gets faster and wider. In-scope organisations must send an initial notification within 24 hours of becoming aware of a significant incident and a fuller report within 72 hours, to their regulator and to the National Cyber Security Centre (NCSC) at the same time. The definition also widens to incidents that are likely to have a significant impact, not only those that have already disrupted the service. Data centres, digital service providers and MSPs must also tell customers likely to have been affected. The exact thresholds will be set in secondary legislation after consultation.

For comparison, the current NIS Regulations require operators of essential services to report without undue delay and no later than 72 hours after becoming aware.

What are the penalties under the bill?

The bill replaces today’s three penalty bands (up to £1 million, £8.5 million and £17 million) with two:

Regulators must weigh factors such as mitigation and past compliance, and fines can be appealed. Peers debated senior executive liability at committee stage, but the bill as it stands does not make directors personally liable. Board-level expectations sit in the voluntary Cyber Governance Code of Practice, and the government’s summary of the bill lists version 4.0 of the NCSC’s Cyber Assessment Framework among the wider support around it.

How does the bill relate to the NIS Regulations and the NIS Directive?

The NIS Regulations 2018 implemented the original EU NIS Directive in UK law and have applied since 10 May 2018. The UK kept them after Brexit. The EU has since replaced that directive with NIS2, which is not part of UK law, so this bill is the UK’s own update to the 2018 Regulations.

Cyber Security and Resilience Bill vs NIS2: what is the difference?

The two share a goal but differ in reach and detail:

A UK company can face both. If you have an EU establishment, or provide services such as managed or cloud services into the EU, read our NIS2 guide for UK businesses.

Is the Cyber Security and Resilience Bill the same as the EU Cyber Resilience Act?

No, although the names are easily confused: this bill is often called the “Cyber Resilience Bill”, and “cyber resilience act UK” is often used to mean it. The EU Cyber Resilience Act, Regulation (EU) 2024/2847, sets security requirements for hardware and software products sold in the EU, and it reaches UK manufacturers that sell there. Our EU Cyber Resilience Act guide covers it.

What should MSPs and suppliers do now?

You do not need to wait for Royal Assent. These steps help whatever the final thresholds:

1. Check your status. Compare your services and size with the MSP definition, and ask whether an essential service customer could treat you as a critical supplier.
2. Expect customer questions. Essential service operators and digital service providers are likely to add security and reporting terms to contracts.
3. Build a 24-hour reporting path. Decide who confirms an incident, who notifies the regulator and NCSC, and how you identify affected customers, and write it into your incident response plan.
4. Baseline against the NCSC CAF. Many NIS regulators already use the Cyber Assessment Framework to assess operators, so it is the sensible yardstick until the new requirements are published.
5. Get independent evidence. Cyber Essentials Plus for your own organisation, an ISO 27001 management system and regular penetration testing of remote management tools show the basics are in place.
6. Follow the consultation. The secondary legislation will set thresholds, security requirements and timings.

Why Sovereign Secure

Sovereign Secure Ltd was founded in 2012 and is based in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. We help organisations show they manage the risks the bill targets:

• IASME-licensed Cyber Essentials certification body. We certify MSPs and their clients for Cyber Essentials and Cyber Essentials Plus through our MSP partner programme.
• ISO 27001 certified. We provide ISO 27001 consultancy, with certification audits carried out by our partner certification body, MQA International.
• Penetration testing and vulnerability scanning, including the remote access tools an MSP relies on.
• PCI SSC Qualified Security Assessor (QSA), QPA and CPSA company and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) 2026-2028.

Next step

If the bill is likely to affect you or your customers, talk to us about Cyber Essentials Plus, ISO 27001 or a penetration test scoped to your managed services.