The Cyber Security and Resilience Bill is the biggest change to UK cyber security regulation since 2018. It brings managed service providers and data centres into scope, sets a 24-hour deadline for reporting significant incidents and raises maximum fines to £17 million or 4% of worldwide turnover. Even if your organisation isn't regulated directly, you'll feel it through the IT and cloud providers you rely on.
For IT and security leaders, the Bill centres on incident response, supply chain risk management and the resilience of essential services. Much of the detail will follow in secondary legislation after Royal Assent, but the most useful steps, such as tightening your incident reporting process and reviewing critical suppliers, make sense whatever the final rules say.
With new requirements expected around incident reporting, supply chain security and operational resilience, now is the time for organisations to understand the implications of the Cyber Security and Resilience Bill and start preparing for the changes ahead.
What is the Cyber Security and Resilience Bill?
The Cyber Security and Resilience (Network and Information Systems) Bill is new UK legislation that updates the NIS Regulations 2018, the rules that set cyber security duties for operators of essential services and some digital services. According to the government's summary of the Bill, it brings more organisations into scope, introduces tighter incident reporting and gives government the power to update the regime as threats change.
The Bill applies across the whole of the UK. Today, the NIS Regulations cover energy, transport, health, drinking water and digital infrastructure, plus online marketplaces, search engines and cloud computing services.
Where does the Bill stand in November 2026?
The House of Lords gave the Bill its third reading on 2 November 2026. It’s now back in the House of Commons, where MPs will consider the amendments the Lords made. No date has been set for this stage yet. Once both Houses agree the final text, the Bill receives Royal Assent and becomes law. Here’s how it’s progressed, based on the UK Parliament bill tracker.
| Stage | Date |
| Commons consideration of Lords amendments | Date to be confirmed |
| Lords third reading | 2 November 2026 |
| Lords report stage | 26 October 2026 |
| Lords committee stage | From 1 September 2026 |
| Lords second reading | 14 July 2026 |
| Lords first reading | 17 June 2026 |
| Commons report stage and third reading | 16 June 2026 |
| Carried over and reintroduced in the new session | 14 May 2026 |
| Commons committee stage | From 3 February 2026 |
| Commons second reading | 6 January 2026 |
| Introduced in the Commons | 12 November 2025 |
Once it becomes law, the measures will come in in phases. The future-proofing powers start the day after Royal Assent, and the statement of strategic priorities and information-sharing rules follow two months later. Most of the operational duties, including incident reporting, the new categories of regulated organisation and the critical supplier rules, will start through secondary legislation. The government plans to consult on these first and give organisations time to adjust.
Who does the Cyber Security and Resilience Bill apply to?
The Bill keeps everyone already regulated under NIS in scope and adds four new groups. If your organisation is an operator of essential services, you'll also feel the effect through your suppliers, because the managed service providers, data centres and critical suppliers you rely on may now have duties of their own.
| Who | What's changing | Regulator |
| Operators of essential services (energy, transport, health, drinking water, digital infrastructure) | Already in scope, with tighter incident reporting and higher penalties | Existing sector regulators |
| Relevant digital service providers (online marketplaces, search engines, cloud computing) | Already in scope, with new duties to tell affected customers about incidents | Information Commission |
| Data centres (medium, large and enterprise sites that meet the thresholds) | Newly regulated, with duties to register, manage risk and report incidents | Ofcom |
| Relevant managed service providers (medium and large) | Newly regulated, with duties to register, manage risk and report incidents | Information Commission |
| Large load controllers (organisations managing electrical load for smart devices, such as EV charging) | Newly regulated | Great Britain: DESNZ and Ofgem Northern Ireland: Department of Finance |
| Designated critical suppliers | Regulators can designate a supplier whose disruption would seriously affect essential or digital services | The relevant sector regulator |
The managed service provider factsheet provided by UK government's summary lists services such as remote IT support, helpdesks, security operations centres, firewall and router management, backups and cloud service management. Small and micro providers are exempt, although they can still be designated as critical suppliers. In-scope managed service providers will have three months from commencement to register with the Information Commission.
The critical supplier factsheet explains that designation targets single points of failure. A regulator must consult the supplier first, and designated suppliers can appeal to the First-tier Tribunal.
How does the Bill change incident reporting
The Bill introduces a two-stage reporting process, with an initial notification within 24 hours of becoming aware of a significant incident and a full report within 72 hours. Both go to your regulator and the National Cyber Security Centre (NCSC) is informed at the same time, as set out in the incident reporting factsheet.
The definition of a reportable incident is also wider. It covers incidents that have, or are likely to have, a significant impact in the UK, so ransomware and pre-positioning attacks count even before they cause disruption. Regulators will judge significance using factors such as the number of users affected, how long the disruption lasts, the area affected and whether data has been compromised.
| Notification | Deadline | What to include |
| Initial notification | Within 24 hours of becoming aware | Your organisation's name, the affected service and brief details of the incident |
| Full report | Within 72 hours | When it started and whether it's ongoing, its nature and impact, and whether another regulated organisation's incident caused it |
| Customer notification (data centres, digital and managed service providers) | After the full report | Incident details and why the customer is likely to be affected, so they can act to reduce harm |
For your incident response plan, this means three practical changes. You'll need a clear way to decide quickly whether an incident is significant, named people who can file a regulator notification out of hours, and enough logging and monitoring to give an accurate account within 72 hours. Our guide to building a cyber incident response plan walks through each stage, and our CyberGuard incident response team can support you when an incident happens.
The customer notification duty matters too. If your managed service or cloud provider has an incident, you'll now hear about it directly, which gives your own team a head start on containment. It's worth agreeing now who receives those notices and how they feed into your breach response.
What does the Bill mean for risk management and cyber security compliance?
The Bill raises the stakes for cyber security compliance by simplifying penalties into two bands and linking the top fines to turnover. Under the current NIS Regulations, the maximum fine is £17 million. The enforcement factsheet sets out the new bands.
| Penalty band | Maximum fine | Applies to |
| Higher band | £17 million or 4% of worldwide turnover, which is higher | Breaches of security and incident notification duties |
| Lower band | £10 million or 2% of worldwide turnover, which is higher | Less serious breaches, such as failing to register as a digital or managed service provider |
Risk management under the Bill also reaches further into your supply chain. Managed service providers must manage risks to the systems they use to deliver services, in line with current best practice, and regulators can designate critical suppliers who then take on their own security duties. If you're regulated, expect your third-party risk register to get more attention from your regulator, so it helps to know which suppliers support your essential services and what you'd do if one of them went offline. Our article on understanding business dependencies for continuity is a good starting point.
There are a few other changes worth noting.
- A statement of strategic priorities from the Secretary of State will set outcomes every NIS regulator must work towards, which should make expectations more consistent across sectors.
- Government can direct regulators or regulated organisations to take specific action where there's a threat to national security.
- Regulators can recover the full cost of their NIS work through charging schemes.
- Government can add sectors or update security requirements through secondary legislation, so the regime can keep pace with new threats.
If you already work to the NCSC's Cyber Assessment Framework (CAF), you've got a strong foundation. Our cyber risk and compliance team can help you map your controls against the Bill's requirements as the secondary legislation is published.
How can you start operational resilience planning for the Bill?
You can start operational resilience planning now by checking whether you're in scope, testing your reporting process against the 24-hour and 72-hour deadlines and reviewing your critical suppliers. The secondary legislation will add detail, but these steps hold true whatever the final thresholds look like.
| Area | What to do now | Helpful resources |
| Scope | Confirm whether you're an operator of essential services, a digital or managed service provider, or a likely critical supplier | Government factsheets |
| Incident response | Update your plan with the 24-hour and 72-hour steps, named owners and out-of-hours contacts | Incident response |
| Detection and logging | Make sure you can spot incidents early and pull together an accurate timeline | Managed SOC, MDR |
| Supply chain risk | Map the suppliers behind each essential service and agree how they'll notify you of incidents | Cyber risk and compliance |
| Testing | Run tabletop exercises and technical tests that reflect real attack scenarios | Penetration testing, crisis readiness steps |
| Recovery | Set recovery targets for critical services and check your backups can be restored | Data protection, disaster recovery plan |
| Assurance | Benchmark your controls against the CAF and track progress at board level | CyberGuard Assurance |
Resilience depends on recovery as much as prevention. A clear view of your recovery time and recovery point objectives helps you decide which services come back first after an incident, and our guide to RTO vs RPO explains how to set them. It's also worth keeping offline plans so your team can still communicate and report if core systems are unavailable.
Finally, bring your board in early. The higher penalties and new reporting duties make cyber security and operational resilience a board-level topic, and our 20 questions every IT leader should be asking can help you frame that conversation.
How we can help you prepare
We help UK organisations build cyber security and operational resilience that stands up to real incidents and regulatory scrutiny. Our incident response team is CREST-approved and available 24/7/365, and our penetration testing is NCSC CHECK accredited. Our CyberGuard services cover the full lifecycle, from assessing your current position to monitoring your systems around the clock and supporting you through an incident.
Our cyber risk and compliance consultants can review your readiness for the Bill and the CAF, while our managed SOC and managed detection and response services help you spot and contain threats quickly. If you do have an incident, our incident response team works alongside yours, and our data protection services help you get critical systems back online.
To find out where you stand, talk to us about a readiness review for the Cyber Security and Resilience Bill.
Frequently asked questions
When will the Cyber Security and Resilience Bill become law?
The Bill completed its Lords stages with a third reading on 2 November 2026. It now returns to the House of Commons so MPs can consider the Lords amendments. Once both Houses agree the final wording, it’ll receive Royal Assent. Most of the new duties will then come in through secondary legislation after a government consultation, so you’ll have time to prepare.
What are the incident reporting deadlines under the Bill?
You'll need to send an initial notification within 24 hours of becoming aware of a significant incident and a full report within 72 hours. Both go to your regulator, and the NCSC is informed at the same time.
Are managed service providers covered by the Bill?
Yes. Medium and large managed service providers that offer services in the UK will be regulated by the Information Commission. They'll need to register within three months of commencement, manage cyber risk and report significant incidents.
What are the penalties for breaching the Bill?
The most serious breaches carry fines of up to £17 million or 4% of worldwide turnover, whichever is higher. Less serious breaches carry fines of up to £10 million or 2% of worldwide turnover.
How is the Bill different from the NIS Regulations 2018?
The Bill updates the NIS Regulations rather than replacing them. It adds data centres, managed service providers, large load controllers and designated critical suppliers to the regime, introduces faster two-stage incident reporting and raises the maximum penalties.
