The UK Cyber Security and Resilience Bill: Could It Affect Your Business?

The UK is proposing a significant expansion of the rules protecting essential services and digital infrastructure from cyber attacks. The Cyber Security and Resilience Bill — formally the Cyber Security and Resilience (Network and Information Systems) Bill — would update the existing Network and Information Systems Regulations 2018.

Its proposals include bringing certain managed service providers, data centres, large electricity-load controllers and critical suppliers within the regulatory framework. It would also expand incident-reporting duties and strengthen the powers available to regulators.

Most ordinary SMEs will not automatically become directly regulated. However, many rely heavily on MSPs, cloud services, data centres and other suppliers that could be affected. That means the Bill matters not only to organisations named in the legislation, but also to their customers and supply chains.

What happened?

The Cyber Security and Resilience Bill proposes reforms and additions to the Network and Information Systems Regulations 2018 — usually shortened to the NIS Regulations. The existing NIS Regulations apply to selected essential and digital services, including areas such as energy, transport, healthcare, drinking water, digital infrastructure and selected digital services such as cloud computing, online marketplaces and search engines. They do not cover the whole economy.

The proposed Bill seeks to:

• Widen the organisations covered
• Improve cyber-incident reporting
• Strengthen regulatory oversight
• Improve information sharing
• Give regulators clearer enforcement and cost-recovery powers
• Allow the government to respond more quickly to evolving threats
• Improve the security of important technology supply chains

As at 28 July 2026, the Bill has completed its stages in the House of Commons and its Second Reading in the House of Lords (14 July 2026). Committee stage in the Lords is scheduled to begin on 1 September 2026, with further sittings listed for 3, 7 and 9 September 2026. The current version is HL Bill 32, as brought from the Commons on 17 June 2026.

Who may be directly affected?

The principal proposed additions, in plain English, are set out below. In each case the proposed criteria, thresholds and final definitions must be checked against the latest version of the Bill and any subsequent regulations.

Managed service providers

Certain managed service providers may be brought into scope because they can have extensive access to customers’ systems, networks, administrative accounts, data, cloud services, security tools and backup platforms. This does not mean that every IT support company or MSP will be regulated — the Bill proposes criteria and definitions that will determine which providers qualify, and those details may still change.

Data centres

Qualifying data centres and enterprise data centres may become regulated because they underpin cloud services, business applications, communications, financial systems, public services and stored business data.

Large load controllers

Organisations controlling significant electrical demand, including certain smart-energy and EV-charging arrangements, may be brought within scope because disruption could affect the electricity system.

Critical suppliers

Regulators may be able to designate certain suppliers as critical where disruption to that supplier could seriously affect an essential or digital service.

Why managed service providers matter

MSPs can administer technology for multiple customers through remote-management platforms, privileged accounts, Microsoft 365 administration, backup systems, endpoint security platforms, network equipment, cloud infrastructure and support tools. A security failure at one provider can potentially affect numerous customers at once.

The Bill reflects a wider change in regulatory thinking: cyber security is no longer viewed only as the responsibility of the organisation using the system. The resilience of key technology suppliers also matters.

That said, regulation does not automatically guarantee that an MSP is secure. Regulation may raise expectations, but customers must still carry out appropriate supplier checks.

How incident reporting may change

The Bill proposes broader and faster reporting of certain cyber incidents. Subject to the final legislation and supporting regulations, regulated organisations may need to provide an initial notification within 24 hours of becoming aware of a significant incident, followed by a fuller report within 72 hours. Relevant MSPs, digital-service providers and data centres may also need to inform affected customers where appropriate.

• Not every minor IT incident will necessarily be reportable.
• Thresholds and definitions matter.
• Detailed requirements may be set through later regulations.
• These are proposed regulatory duties, not a general obligation currently applying to every SME.

Why does this matter to customers? A business may need timely information from its IT provider to protect its own systems, reset credentials, isolate affected devices, communicate with customers, meet contractual obligations, assess data-protection reporting and continue critical operations.

Does the Bill apply to ordinary SMEs?

Direct effect

Most ordinary small businesses will not automatically become directly regulated simply because they use computers, Microsoft 365 or an outsourced IT provider.

Possible direct effect

A business should seek specialist advice where it:

• Provides managed technology services
• Operates qualifying data-centre services
• Provides services to essential operators
• Could be designated as a critical supplier
• Already falls within the NIS regime
• Operates in a regulated or critical sector

Indirect effect

Many SMEs may be indirectly affected because their MSP, cloud provider, data-centre provider, software supplier, sector customer, insurer, procurement partner, regulator or larger supply-chain customer may introduce stronger contractual and assurance requirements.

Possible indirect consequences include requests for:

• Cyber Essentials or Cyber Essentials Plus
• Security questionnaires
• Incident-response plans
• Evidence of backups
• Multi-factor authentication
• Vulnerability management
• Staff training
• Business-continuity arrangements
• Supplier registers
• Prompt incident notification
• Contractual audit rights

What could this mean for MSP customers?

If the Bill proceeds broadly as proposed, customers of MSPs and other technology suppliers may see:

• More detailed security assessments
• Clearer division of responsibilities
• Improved incident-notification clauses
• Stronger access controls
• More formal onboarding and offboarding
• Better audit logging
• Increased emphasis on supported systems
• Tighter requirements around backups and recovery
• Greater scrutiny of remote-management tools
• More structured business-continuity planning
• Changes to contracts or pricing

Some additional cost may result where providers must improve internal controls, maintain evidence, report to regulators, undergo assessments, invest in resilience and strengthen staffing and monitoring. That does not mean every MSP will automatically increase prices — and improved resilience may reduce the likelihood and impact of serious incidents, which carries real value of its own.

Cyber security versus cyber resilience

The Bill’s title includes both words deliberately, and the distinction matters for every business.

Practical business implications

Supplier visibility

• Which providers can access your systems
• Which services are business-critical
• Where data is hosted
• Who owns each supplier relationship
• How to contact the supplier during an incident

Contracts

• Who is responsible for each security control
• How quickly incidents must be reported
• What information the supplier must provide
• Who owns and can export the data
• How services will be recovered
• What happens when the relationship ends

Incident response

• Who can make decisions
• Who contacts the IT provider
• Who contacts insurers
• Who assesses ICO reporting
• Who communicates with staff and customers
• How operations continue if email or phones are unavailable

Backups and recovery

The existence of a backup is not enough. Businesses should know what is backed up, how often, whether backups are encrypted, whether they are separated from the main environment, how long recovery takes and when restoration was last tested.

Questions to Ask Your IT Provider

1. 1Could your organisation fall within the scope of the Cyber Security and Resilience Bill?
2. 2Which of your services have administrative access to our systems?
3. 3Which third-party platforms do you use to support us?
4. 4How are privileged accounts protected?
5. 5Is multi-factor authentication enforced across your support platforms?
6. 6How quickly would you tell us about an incident that could affect our business?
7. 7Is that notification period included in our contract?
8. 8What information would you provide during an incident?
9. 9How is access to our systems logged and reviewed?
10. 10How do you secure remote-management tools?
11. 11What happens if your own systems become unavailable?
12. 12Do you have tested business-continuity and disaster-recovery arrangements?
13. 13How are our backups protected from compromise?
14. 14When was our recovery process last tested?
15. 15Which responsibilities belong to you and which remain with us?
16. 16Can we obtain our configurations, credentials and data if we change provider?
17. 17Do you hold Cyber Essentials, Cyber Essentials Plus, ISO 27001 or other relevant assurance?
18. 18How do you assess the security of your own suppliers?
19. 19Who should we contact during an urgent cyber incident?
20. 20What changes do you expect the Bill to require from your organisation?

Certifications and assurance schemes are useful evidence, but they do not remove the need for your own due diligence.

The IT Club View

The Cyber Security and Resilience Bill is primarily aimed at the services and suppliers whose disruption could cause wider harm. However, its influence is likely to reach much further than the organisations named directly in the legislation.

Large customers, regulators, insurers and providers are increasingly asking smaller businesses to demonstrate basic cyber hygiene and operational resilience. That is not necessarily unreasonable. An organisation cannot outsource responsibility simply by outsourcing its IT. At the same time, small businesses should be able to expect greater transparency and resilience from providers that hold powerful access to their systems.

The most useful question is not simply, “Does this law apply to us?” It is, “Would our business and our technology providers be ready for the standards it is trying to create?” The Bill’s final scope and details may change as it completes its passage — but the direction of travel is clear, and preparation loses none of its value if the details shift.

The Operational Heartbeat

Cyber resilience cannot be established through a one-off audit. A recurring review should include administrator accounts, supplier access, missing security updates, endpoint protection status, backup success, restore testing, unsupported systems, user and leaver accounts, incident contacts, continuity arrangements, critical supplier changes and insurance requirements.

Cyber resilience needs an operational heartbeat: controls should be checked, failures should be acted upon and recovery should be tested before an emergency.

This article provides general technology and cyber-security information, not legal advice. Organisations that may fall directly within scope should obtain appropriate legal, regulatory and technical advice.