The Cyber Security and Resilience Bill, formally the Cyber Security and Resilience (Network and Information Systems) Bill, updates the UK's main cross-sector cyber law, the NIS Regulations 2018. It brings managed service providers, data centres and large load controllers into scope and lets regulators designate critical suppliers. It also requires an initial incident notification within 24 hours and a full report within 72 hours, and raises maximum fines to £17 million or 4% of worldwide turnover, whichever is higher. At 7 October 2026 the Bill has not yet become law. It has passed the Commons, and its House of Lords report stage is scheduled for 26 October 2026.
Where the Bill is in Parliament
The Bill was introduced in the Commons on 12 November 2025. It had its second reading on 6 January 2026, when it was also carried over into the next session, and was reintroduced on 14 May 2026. It completed its Commons report stage and third reading on 16 June 2026. In the Lords it had its second reading on 14 July 2026 and its committee stage in early September 2026.
Once it receives Royal Assent, it will come into force in phases. A few measures take effect on day one or in month two. Most of the substantive duties, including the new sectors, critical suppliers, incident reporting and cost recovery, will be switched on later by commencement regulations after consultation. The government has said a business adjustment period will be announced before new duties apply.
Who is brought into scope
The NIS Regulations currently cover operators of essential services in energy, transport, health, drinking water and digital infrastructure, plus some digital services: online marketplaces, search engines and cloud computing. The Bill adds:
- Relevant managed service providers. These are medium and large MSPs that provide ongoing management of a customer's IT, such as helpdesks or outsourced security. They will be regulated by the Information Commission and must register within three months of the rules commencing. Small and micro MSPs are exempt, unless they are designated as critical suppliers;
- Data centres. These are classed as essential services and regulated by Ofcom. A data centre is in scope with rated IT load of 1 MW or more, and an enterprise data centre (run solely for its owner's own IT) with 10 MW or more;
- Large load controllers. These are organisations that manage electrical load for smart appliances, such as EV charging;
- Designated critical suppliers. A regulator will be able to designate a supplier that provides goods or services directly to an entity it regulates. To be designated, an incident at the supplier must have the potential to disrupt essential or digital services in a way likely to have a significant impact on the economy or day-to-day life. Small and micro firms can be designated.
Software sold as a product, or a one-off installation with no ongoing management, would not make a business a relevant managed service provider.
Incident reporting and customer notification
The current regime only requires incidents to be reported once they have significantly disrupted a service, and the deadline is 72 hours. The Bill widens this to incidents that could have a significant impact, such as ransomware or pre-positioning attacks by a state actor that have not yet caused disruption but are likely to have a significant impact. The new sequence is:
- Within 24 hours of becoming aware, a light-touch initial notification to the regulator, with the National Cyber Security Centre informed at the same time;
- Within 72 hours, a fuller report;
- For data centres, MSPs and digital service providers, identifying and notifying customers who are likely to have been adversely affected.
Supplementary reporting thresholds will be set in secondary legislation after consultation.
Penalties
The NIS Regulations now have three penalty bands, with maximums of £1 million, £8.5 million and £17 million. The Bill replaces these with two bands:
| Band | Examples | Maximum penalty |
|---|---|---|
| Higher | Failing to meet security duties or to notify incidents | £17 million or 4% of worldwide turnover, whichever is higher |
| Lower | Administrative failures, such as not registering | £10 million or 2% of worldwide turnover, whichever is higher |
How "turnover" is measured will be set in secondary legislation. The government's intention is to link it to the regulated services, although group turnover may count where a parent company influenced the decisions behind the breach.
Other powers in the Bill
- Statement of strategic priorities. The Secretary of State will set outcomes that the 12 NIS regulators must seek to achieve;
- Cost recovery. Regulators will be able to recover the full cost of their NIS work through published charging schemes;
- Powers of direction. The government will be able to direct regulators or regulated entities to act against threats to national security;
- Future-proofing. Ministers will be able to add sectors and update security requirements by secondary legislation.
Worked example: an IT support firm
An IT managed services company runs helpdesk, patching and backup services for 150 small businesses and two NHS trusts. Assume it is not a small or micro enterprise. Because it provides ongoing management of client systems, it is likely to be a relevant managed service provider once the measure is commenced. The definition covers providers serving UK customers whether or not they are established in the UK. It would then need to register with the Information Commission within three months and put appropriate and proportionate security measures in place. If a ransomware group got into its remote-management tool, and the incident was likely to have a significant impact, it would have to notify the Commission within 24 hours, even before any client was locked out. After its full report, it would have to work out which clients were likely to be affected and tell them. Separately, the NHS trusts' regulator could consider designating it as a critical supplier.
The practical steps now are to confirm whether the business falls within the RMSP definition, review its incident response plan against a 24-hour clock, and check that client contracts and insurance reflect the new notification duty.
The primary sources are the Bill's page on the Parliament website, the government's Bill factsheets and the current NIS Regulations 2018, regulation 18. See also our guides to operational resilience and Cyber Essentials.
Acumon's cyber security audit and IT risk teams can assess whether the Bill is likely to apply to your business, test incident response against the 24-hour and 72-hour deadlines, and review supplier arrangements ahead of commencement.