UK Cyber Security and Resilience Bill Guide

The UK's only cross-sector cyber law, the NIS Regulations 2018, does not cover the managed service providers, data centres and single suppliers whose compromise has disrupted hospitals, councils and retailers, and it only asks for a report once a service has already been hit. The Cyber Security and Resilience (Network and Information Systems) Bill amends and extends that regime: it brings medium and large managed service providers, data centres and large load controllers into scope, lets regulators designate critical suppliers, adds a 24-hour initial incident notification and raises penalties. This guide explains the existing NIS regime, what the Bill changes, where it stood in Parliament when checked on 18 October 2026, and how to prepare before the secondary legislation that will switch most measures on. It is written for CISOs, compliance leads and security teams at operators of essential services, digital service providers, managed service providers and their suppliers.

Key takeaways

• It is still a Bill. When checked on bills.parliament.uk on 18 October 2026 it had passed the Commons, completed Lords Grand Committee, was scheduled for Lords Report stage on 26 October 2026 and had not received Royal Assent.
• Scope widens beyond operators. Medium and large managed service providers become regulated as relevant managed service providers (RMSPs), data centres of 1 MW or more (10 MW for enterprise sites) and large load controllers of 300 MW or more become essential services.
• Reporting gets faster and broader. An initial notification within 24 hours and a fuller report within 72 hours, sent to the regulator with the NCSC informed at the same time, and incidents capable of significant impact are reportable before any disruption.
• Suppliers can be pulled in individually. Regulators can designate a critical supplier, including a small or micro firm, where its disruption would have a significant impact on the economy or daily life.
• Most duties arrive through regulations. Security requirements, reporting thresholds, data centre and supplier rules all commence through secondary legislation after Royal Assent, so the detail is still to be consulted on.

Where the Bill stands

The UK Cyber Security and Resilience Bill is a Department for Science, Innovation and Technology bill carried over between sessions. The stages below are as listed on the Parliament bill page on 18 October 2026; later Lords dates are scheduled and can move. For the cross-jurisdiction picture, see the Global Cybersecurity Regulatory Map.

The current regime: NIS Regulations 2018

The UK NIS regime rests on the Network and Information Systems Regulations 2018 (SI 2018/506), which apply to two groups and are overseen by twelve regulators.

• Operators of essential services (OES): designated organisations in energy (electricity, oil, gas), transport (air, rail, water, road), health, drinking water supply and distribution, and digital infrastructure such as internet exchange points and DNS providers. Regulation 10 requires "appropriate and proportionate technical and organisational measures" to manage risk to the systems the essential service relies on, measures to prevent and minimise the impact of incidents, and regard to competent authority guidance.
• Relevant digital service providers (RDSPs): online marketplaces, online search engines and cloud computing services. Regulation 12 requires security measures covering five areas carried over from Implementing Regulation (EU) 2018/151: security of systems and facilities, incident handling, business continuity, monitoring, auditing and testing, and compliance with international standards.
• Incident reporting: an OES notifies its competent authority of an incident with a significant impact on continuity of the essential service, judged on users affected, duration and geographic area, "without undue delay and in any event no later than 72 hours" after becoming aware (regulation 11). RDSPs notify the Information Commission of incidents with a substantial impact on the same 72-hour basis.
• Assessment basis: most competent authorities assess OES against the NCSC Cyber Assessment Framework (CAF), now version 4.0, with four objectives (A managing security risk, B protecting against cyber attack, C detecting cyber security events, D minimising the impact of incidents) and 14 principles.

NIS competent authorities

Post-implementation reviews in 2020 and 2022 found inconsistent implementation across sectors, and the 2018 regime leaves out the supply chain that essential services depend on.

What the Bill changes at a glance

Who comes into scope

Relevant managed service providers

The managed service providers factsheet defines a managed service as one provided under contract that gives ongoing management of a customer's IT systems, such as support, monitoring or active administration, and that connects to or accesses the customer's networks, on site or remotely. Under the Bill, a relevant managed service provider is anyone providing managed services in the UK who is not a small or micro enterprise, whether or not established in the UK. The April 2025 policy statement estimated 900 to 1,100 MSPs would be covered.

RMSPs must register with the Information Commission within three months of commencement, appoint a UK representative if based overseas, manage risk with appropriate and proportionate measures, and report significant incidents. Providers of data centre services and public electronic communications are excluded from the RMSP definition because they are covered elsewhere.

Data centres

Data centres under NIS become essential services in a new data infrastructure sector, regulated by Ofcom. Facilities are in scope at a rated IT load of 1 MW or more, and enterprise data centres run solely for the owner's own IT at 10 MW or more. Operators must notify Ofcom within three months of being designated, follow a statutory code of practice and face information notices, inspections and daily fines for continuing breaches.

Large load controllers

Organisations that remotely manage the electrical load of energy smart appliances, such as battery storage and EV charging, are designated where they control a combined potential capacity of 300 MW or more. The Department for Energy Security and Net Zero and Ofgem act as joint competent authorities. The concern is grid stability.

Designated critical suppliers

A regulator can designate a supplier as critical only if four conditions are met: it supplies an OES, RDSP or RMSP regulated by that regulator directly; it relies on network and information systems to do so; an incident could disrupt the essential, digital or managed service; and the disruption is likely to have a significant impact on the economy or the day-to-day functioning of society. Regulators must consider whether the supply could be sourced elsewhere and whether other regimes already address the risk. In a critical supplier designation the supplier is consulted, regulators coordinate, appeals go to the First-tier Tribunal, and requirements will be no more stringent than those for OES, RDSPs and RMSPs. The government's case study is the June 2024 attack on an NHS pathology supplier that affected more than 11,000 appointments and procedures.

Incident reporting: 24 hours and 72 hours

UK NIS incident reporting changes most. For OES (other than data centres), RDSPs and RMSPs, an incident is reportable when it has adversely affected, or is affecting, the operation or security of network and information systems, its impact has been, is or is likely to be significant, and the impact relates to all or part of the UK. The factsheet says ransomware and pre-positioning attacks are covered "even if they have not had an impact yet". Supplementary thresholds will follow in secondary legislation and regulator guidance.

1. Within 24 hours of becoming aware that an incident is taking place: an initial notification with the entity's name, the affected service and brief details, to the regulator with the NCSC copied.
2. Within 72 hours: a full report, so far as known, covering when the incident occurred and whether it is ongoing, its nature, whether it was caused by an incident at another regulated entity, its actual or likely impact, and anything else the regulator needs.
3. After the full report: RDSPs, RMSPs and data centre operators identify customers likely to have been adversely affected and tell them, with the reasons, so they can mitigate harm.

This UK 24 hour incident reporting step mirrors NIS2 Article 23, which uses a 24-hour early warning and 72-hour notification. See the NIS2 Directive Guide. Personal data breaches still go to the Information Commission under UK GDPR on their own 72-hour clock, so a single event may trigger both.

Enforcement and penalties

UK NIS penalties today top out at £17 million, which the enforcement factsheet calls disproportionate for large entities. The Bill replaces three bands with two and puts the allocation of breaches to bands in law.

UK NIS enforcement will follow a set process: turnover is defined in regulations (group turnover can count where a parent influenced the breach), regulators weigh mitigation and compliance history, may pair a notice of intent with an enforcement notice requiring corrective action, and must consider representations; penalty decisions can be appealed to the First-tier Tribunal. Remediation evidence reduces fines.

Regulator and government powers, and when duties start

• Statement of strategic priorities: the Secretary of State sets outcomes regulators must seek to achieve.
• Information sharing: clearer gateways between regulators, the NCSC, law enforcement and intelligence agencies.
• Cost recovery: regulators can recover the full cost of NIS functions through charging schemes, so expect fees.
• Future-proofing: ministers can bring new sectors into scope and update security requirements by secondary legislation after consultation.
• Powers of direction: government can direct regulators or regulated entities to take targeted, proportionate action against imminent threats to national security.

The summary factsheet sets the commencement order: future-proofing powers on day one; the statement of strategic priorities and information sharing two months after Royal Assent; and powers of direction, data centres, RMSP and RDSP updates, large load controllers, critical suppliers, incident reporting and cost recovery by regulations on dates the Secretary of State sets. Government plans to consult on implementation in 2026, and the impact assessment estimates the cost at under £150 million a year.

Where identity fits

MSPs are in scope because they hold standing, privileged, remote access into many customers at once. The incidents behind the Bill typically start with a supplier's account, a remote management tool or a help desk reset rather than an exotic exploit, as in the Marks and Spencer cyberattack. For RMSPs the security duty will in practice mean phishing-resistant MFA for technicians, per-customer separation of administrative identities, just-in-time elevation, vaulted service account and API credentials, and complete logging of remote sessions. See the Third-Party Access Guide and the RMM Tool Security Guide.

How to prepare: a phased approach

1. Determine your position: confirm whether you are an OES or RDSP today, whether your services meet the RMSP definition and size test, whether you run data centres over 1 MW (or 10 MW enterprise), and which of your customers are regulated and might nominate you as a critical supplier.
2. Baseline against the CAF: run a CAF self-assessment for the systems behind the service, using the basic profile as a floor and a sector enhanced profile where one applies. RMSPs without a regulator yet should treat CAF outcomes as the most likely benchmark, since the policy statement points to it.
3. Rebuild the reporting process around 24 hours: define who decides that an incident "is likely" to be significant, pre-draft the initial notification fields, list regulator and NCSC routes, and add the customer notification step with a customer-to-service map.
4. Test it: run a tabletop where a ransomware intrusion is found before encryption and the clock starts at detection. Measure time to decision and to a sendable notice. See the Tabletop Exercise Guide.
5. Fix supply chain visibility: tier suppliers by impact, add notification, audit and security clauses, and plan for suppliers that will now notify you.
6. Keep the current process live: until regulations commence the 2018 rules apply, so run the new 24-hour step alongside the existing 72-hour duty and only retire old procedures when the commencement regulations are made.
7. Track secondary legislation: respond to the 2026 consultations on thresholds, size tests and security requirements, and update scope decisions when the final regulations are laid.

Decision guidance

• MSP or software vendor: if you hold ongoing contracted access to administer, monitor or support a customer's IT, plan as an RMSP. If you sell software and patch it ad hoc, or install then hand over, the factsheet places you outside the definition, though a customer's regulator could still designate you.
• Small and micro firms: exempt from the RMSP definition but not from designation as a critical supplier. A small firm that is the sole supplier of a hospital or water system service should prepare as if designation were possible.
• Large groups: map regulated services to legal entities early, because penalties may reach group turnover and different regulators may apply to different subsidiaries.
• OT providers: OT-only automation suppliers are outside the RMSP measure, but OT inside an OES remains covered by the NIS duties. See the OT Security Guide.

Measurement and framework mapping

Metrics that show readiness:

• Median time from detection to an initial notification decision, measured in exercises (target well under 24 hours).
• Percentage of regulated services with a current CAF self-assessment and named owner.
• Percentage of critical suppliers with contractual incident notification and an up-to-date contact.
• Percentage of third-party privileged accounts with phishing-resistant MFA and session logging.
• Percentage of customers mapped to the services and systems that support them (RMSPs and data centres).

Common failure patterns

• Waiting for Royal Assent: the 24-hour clock needs decision rights, contacts and a customer map that take months to build.
• Assuming "we sell software" means out of scope: many vendors also run managed or hosted services under contract that meet the RMSP definition.
• Reporting only after disruption: the new threshold catches likely impact, so a contained ransomware staging find may be reportable.
• Treating supplier access as low risk: large UK disruptions, including the Jaguar Land Rover cyberattack, show how far one organisation's compromise spreads through supply chains.
• Separate UK, NIS2 and UK GDPR processes: parallel teams miss clocks or send inconsistent facts to different regulators.

Practitioner checklist

• Record the Bill's current stage and the date you checked it, and re-check before each board update.
• Document whether each service is OES, RDSP, RMSP, data centre or potential critical supplier, with the reasoning.
• Complete or refresh a CAF self-assessment for every regulated service.
• Define who can declare an incident reportable and pre-approve the 24-hour notification template.
• Build and maintain a customer-to-service map if you are an RMSP, RDSP or data centre operator.
• Tier suppliers, add incident notification and audit clauses, and identify single points of failure.
• Enforce phishing-resistant MFA, just-in-time access and session logging for all supplier and MSP administrative access.
• Exercise the 24 and 72-hour process at least annually, including NCSC and customer notices.
• Assign an owner to track and respond to the secondary legislation consultations.

Standards and references

• UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill
• GOV.UK: Cyber Security and Resilience (NIS) Bill factsheets
• GOV.UK: Cyber Security and Resilience Bill factsheet, Incident reporting
• GOV.UK: Cyber Security and Resilience Bill factsheet, Relevant managed service providers
• GOV.UK: Cyber Security and Resilience Bill policy statement
• legislation.gov.uk: The Network and Information Systems Regulations 2018, regulation 11
• legislation.gov.uk: The Network and Information Systems Regulations 2018, Schedule 1
• NCSC: Cyber Assessment Framework

Related NHI Mgmt Group resources: Global Cybersecurity Regulatory Map · NIS2 Directive Guide · Third-Party Risk Management Guide · Incident Response Plan Template · Privileged Access Management Guide. This guide summarises the Cyber Security and Resilience (Network and Information Systems) Bill as checked on 18 October 2026 and the NIS Regulations 2018, and is not legal advice.