The Cyber Security and Resilience Bill updates the laws that govern how UK businesses handle cyber risk. If you are an SME in a supply chain, using a managed IT provider, or delivering digital services, the ground beneath you has shifted. This is the plain-English version.
The UK's current cyber security regulations, the NIS Regulations, landed in 2018. They were based on an EU directive that has since been replaced by a much tougher version called NIS2. Meanwhile, the UK has watched the NHS get hit via a managed service provider, the Ministry of Defence lose staff data through a contractor, and high street retailers get publicly dismantled by ransomware gangs. The government's position is simple: the old framework is no longer enough.
As a nation, we must act at pace to improve our digital defences and resilience, and the Cyber Security and Resilience Bill represents a crucial step in better protecting our most critical services.
Richard Horne, CEO, National Cyber Security CentreThe original NIS Regulations covered a fairly narrow set of essential service operators and digital service providers. The Bill expands that in three directions: new types of organisation, critical suppliers who serve those organisations, and a flexible mechanism for the government to add more sectors later.
900 to 1,100 MSPs brought under regulation for the first time. IT management, help desk, and security providers now have statutory obligations.
New in scopeColocation (1MW+) and enterprise (10MW+) now regulated. Must report incidents and notify affected customers.
New in scopeEntities managing electricity to smart appliances (EV charging, heating) with 300MW+ aggregate control.
New in scopeRegulators can label specific suppliers as "critical" if disruption would significantly impact essential services. Even an SME can be designated.
New in scopeAlready in scope. Now subject to stronger requirements, tighter reporting, and enhanced regulator powers.
Online marketplaces, search engines, cloud services. Now must align with the NCSC Cyber Assessment Framework.
The Bill introduces changes that, taken together, represent the biggest overhaul of UK cyber regulation since the framework was created. All of them will filter down to how businesses operate, contract, and plan for incidents.
The Bill introduces a two-stage incident reporting requirement. The clock starts when you discover a significant incident. If your current process is "ring Dave from IT and hope for the best", this is the part that needs to change first.
| NIS 2018 (old) | CSRB (new) | |
|---|---|---|
| Initial report | 72 hours (often longer) | 24 hours from discovery |
| Full report | No fixed requirement | 72 hours from discovery |
| Near misses | Not covered | Reportable if significant |
| Customer notification | Not mandatory | Required for MSPs, data centres, DSPs |
| Regulatory approach | Reactive, complaint-driven | Proactive, investigation-powered |
The new model ties penalties to turnover. For SMEs that fall into scope, either directly or as designated critical suppliers, these numbers are worth understanding.
The output will show what the Bill means for your specific situation and what to prioritise.
Managed service providers are now regulated for the first time. They have to meet security standards, report incidents, and be accountable to regulators, not just to you. These are the questions worth asking.
Estimated UK MSP readiness // Based on DSIT breaches survey + industry benchmarks
Ten items drawn from the Bill's requirements and the NCSC CAF. No data leaves this page.
Who calls whom, what gets disconnected, how you communicate if email is down.
Do you know who the relevant regulator is? Could you do this at 2am on a Saturday?
Authenticator apps minimum, hardware keys if possible.
Especially anyone with access to your systems, data, or payments.
Firewalls, VPNs, servers, remote access tools.
A backup on the same network with the same admin credentials won't survive ransomware.
If cyber only lives in IT, it doesn't have the authority to drive change.
An unmonitored alert is the same as no alert.
Increasingly expected in procurement, by insurers, and by regulated supply chains.
A dedicated button or shared mailbox. Quick, blame-free, and actually monitored.
The 24-hour reporting window means you need to know who does what before the pressure arrives. Get the plan on paper, run a tabletop, find the gaps.
Do they have their own IR plan? Can they report to you within 24 hours? Do they hold Cyber Essentials? If any answer is unclear, you know where your risk lives.
The NCSC CAF is the legal benchmark. Cyber Essentials is the stepping stone. Low cost, high signal to regulators and supply chains.
Only 15% of UK businesses review immediate suppliers. Start with the most critical one. Ask for evidence. Then do the next one.
Email, cloud storage, admin accounts, VPN, finance platforms, backup systems. This single control blocks the majority of credential-based attacks.
The Bill expects governance and accountability at senior level. Put it on the quarterly agenda. Assign ownership. Track progress.
313SEC can review your incident response readiness, supply chain exposure, MSP security posture, and alignment with the NCSC Cyber Assessment Framework. No sales script. Just a real conversation about whether you are ready for what the Bill will require.
You'll get a real reply within a couple of working days. No sequence, no list.
Cybersecurity is a shared responsibility and a foundation for prosperity. We urge all organisations, no matter how big or small, to act with the urgency that the risk requires.
NCSC guidance, October 2025