The short answer: The Cyber Security and Resilience Bill updates the UK’s cyber security law for essential services and, for the first time, brings medium and large managed IT providers into scope. In-scope providers will have to register with the Information Commission, put proportionate security measures in place, report significant incidents within 24 hours and tell affected customers. Most small businesses will not be regulated directly, but the Bill will change what you can expect from your IT provider, and from larger customers you supply. It is not law yet: it has passed the Commons and its Lords Committee stage, and Lords Report stage is scheduled for 26 October 2026.
In this guide:
- What is the Cyber Security and Resilience Bill?
- Where has the Bill got to?
- Who does it apply to?
- Why IT providers are being brought in
- What in-scope IT providers will have to do
- Does it affect my business?
- Eight questions to ask your IT provider
- What to do now
- Frequently asked questions
- Sources
What is the Cyber Security and Resilience Bill?
The Cyber Security and Resilience (Network and Information Systems) Bill reforms the Network and Information Systems Regulations 2018, known as the NIS Regulations. These are the UK’s only cross-sector cyber security law, and they cover essential services such as energy, transport, health, drinking water and digital infrastructure, plus some digital services like cloud computing and online marketplaces. The government describes the 2018 rules as out of date and insufficient.
The Bill has three pillars: widen the scope to cover more of the organisations essential services depend on, give regulators stronger tools, and let the government update the rules quickly as threats change. It also requires more incidents to be reported. The government’s summary of the Bill sets out why:
- Cyber attacks are estimated to cost UK businesses £14.7 billion a year, about 0.5% of GDP.
- Over 40% of UK businesses experienced a cyber attack, equivalent to more than 600,000 organisations.
- The National Cyber Security Centre (NCSC) handled 429 incidents in the year to September 2025, of which 204 were nationally significant, more than double the previous year.
Where has the Bill got to?
The Bill was introduced in the House of Commons in November 2025 and has completed its Commons stages. In the House of Lords it has finished Committee stage, and Report stage is scheduled for 26 October 2026, with Third Reading to follow. The latest version, as amended in Grand Committee, was published on 7 September 2026.
Royal Assent is only the start. A few measures take effect on Royal Assent or two months after, but most of the new duties, including those for managed service providers, critical suppliers and incident reporting, will be switched on later through secondary legislation. The government plans to consult on the detail during 2026 and has said affected organisations will get an adjustment period before new duties apply. We will update this guide as that detail is published.
Who does it apply to?
| Who | Covered now (NIS 2018) | Covered under the Bill |
|---|---|---|
| Operators of essential services (energy, transport, health, water, digital infrastructure) | Yes | Yes |
| Some digital services (cloud computing, online marketplaces, search engines) | Yes, medium and large only | Yes, medium and large only |
| Managed service providers (IT providers) | No | Yes, medium and large |
| Data centres | No | Yes, above set thresholds |
| Large load controllers | No | Yes, above set thresholds |
| Critical suppliers designated by a regulator | No | Yes, of any size |
Source: government factsheets on the Bill, updated 30 June 2026.
Why IT providers are being brought in
Managed service providers usually have broad, trusted access to their customers’ systems. That makes them an attractive target: one successful attack on a provider can reach many businesses at once. The government’s factsheet on managed service providers points to an incident in May 2024 involving an MSP that put the personal data of around 270,000 serving military personnel, reservists and veterans at risk. Its 2025 policy statement estimated that this measure would bring a further 900 to 1,100 MSPs into scope.
A provider is in scope if it provides managed services in the UK, meaning the ongoing management of a customer’s IT systems with access to those systems, and is not a small or micro enterprise. The government gives examples:
| In scope | Out of scope |
|---|---|
| An IT company managing a business’s systems, on site or remotely, including backups, monitoring and firewall management | A company that installs IT systems but does not manage them afterwards |
| An IT security company providing ongoing firewall management and incident response through a connection to the customer’s systems | A software company selling software as a product, including ad hoc remote patch updates |
| An IT company providing ongoing management of a cloud service, including configuration and monitoring | An accountancy, tax or legal firm advising by email, phone or in person |
The small business exemption
Small and micro providers are exempt from the managed service provider duties. The Bill defines size using the EU test in Commission Recommendation 2003/361/EC, the same test the current rules use for digital services:
| Size | Staff | Turnover or balance sheet total |
|---|---|---|
| Micro | Fewer than 10 | Up to €2 million |
| Small | Fewer than 50 | Up to €10 million |
| Medium | Fewer than 250 | Turnover up to €50 million or balance sheet up to €43 million |
So many local IT providers, including the smaller firms most small businesses use, will fall outside the managed service provider rules. Two caveats: a provider that is part of a larger group may have to count the whole group, and any provider, however small, can be designated as a critical supplier.
What in-scope IT providers will have to do
- Register with the Information Commission, the body formerly known as the ICO, which will regulate managed service providers.
- Manage risk by taking appropriate and proportionate measures to protect the systems their managed services rely on, and to prevent and limit the impact of incidents.
- Report significant incidents with a short initial notification within 24 hours and a full report within 72 hours, sent to the regulator with the NCSC informed at the same time. (Incident reporting factsheet.)
- Tell affected customers. After reporting, providers will have to identify customers likely to have been affected and notify them with details of the incident.
- Appoint a UK representative if they are based overseas.
Regulators will be able to inspect, issue enforcement notices and fine. Under the Bill, maximum penalties rise to £17 million or 4% of worldwide turnover, whichever is higher, for the more serious breaches, and £10 million or 2% for less serious ones. What counts as a “significant” incident will be set out in secondary legislation after consultation.
Does it affect my business?
If you run a small business that is not an essential service and not an IT, cloud or data centre provider, the Bill is unlikely to regulate you directly. It can still reach you in three ways.
1. Through your IT provider
If your IT provider is medium or large, it will be regulated. You should see clearer incident notifications, more scrutiny of how it secures remote access to your systems, and possibly new contract terms. If your provider is small, the law will not require any of this, but nothing stops you asking for the same standards.
2. If you supply essential services
Regulators will be able to designate a supplier as critical if it directly supplies an operator of essential services, or a regulated digital or managed service provider, relies on IT to do so, and a disruption to it would have a significant impact on the economy or daily life in the UK. Size is no barrier: small and micro businesses can be designated. Designation follows a set process, including consultation, and can be appealed. We expect it to be uncommon, but it is worth knowing about if you supply the NHS, energy, water or transport.
3. Through larger customers
We expect regulated organisations, and the larger businesses that supply them, to look harder at the security of the suppliers they depend on. In practice that means more security questionnaires and more requests for evidence such as Cyber Essentials when you tender for work. Our analysis of government data shows Cyber Essentials uptake is already rising fast, with contracts among the main reasons firms certify.
Eight questions to ask your IT provider
Whether or not your provider is in scope, these questions tell you a lot about how seriously it takes the access it has to your business:
- Are you in scope of the Cyber Security and Resilience Bill as a managed service provider, and if not, why not?
- If you have a security incident that could affect us, how quickly will you tell us, and is that written into our contract?
- How is your remote access to our systems secured? Does every engineer account use multi-factor authentication?
- Who in your team has administrator access to our systems, and how is that access removed when someone leaves?
- Do you hold Cyber Essentials, or Cyber Essentials Plus? When was it last renewed?
- Where are our backups held, how often are they tested, and could an attacker who got into our network delete them?
- Do you have an incident response plan for your own business, and have you tested it?
- Which other companies do you rely on to support us, such as remote monitoring tools or cloud platforms, and how do you check their security?
If you are weighing up a change of provider, our guide to how managed service providers work explains what a good one should cover.
What to do now
This Bill does not require small businesses to do anything yet, although existing data protection law already does, including reporting serious personal data breaches. The measures behind the Bill are simply good practice, and most are cheap or free:
- Get the basics certified. Cyber Essentials covers the five controls that stop most common attacks, and it is increasingly what customers ask for.
- Turn on multi-factor authentication for every cloud service and every admin account, including your IT provider’s.
- Check your backups are separate from your main network and that someone has actually tested a restore.
- Write a one-page incident plan: who to call, how to reach your IT provider out of hours, and when to contact your insurer and the Information Commission (formerly the ICO).
- Use the free NCSC tools. The Cyber Action Toolkit gives small businesses a tailored set of actions, and Early Warning is a free NCSC service that alerts you to potential attacks on your network.
- Check your email domain. Our free DMARC checker shows in seconds whether criminals can send email that looks like it came from you.
If you would like a second opinion on where your business stands, our cyber security services team in Arundel and Chichester can review your setup and your current provider’s access. We are Cyber Essentials certified ourselves and have supported businesses since 2015.
Frequently asked questions
Is the Cyber Security and Resilience Bill law yet?
Not yet. It has passed the House of Commons and its Lords Committee stage, and Lords Report stage is scheduled for 26 October 2026, with Third Reading to follow. Even after Royal Assent, most of the new duties, including those for managed service providers, will only start once secondary legislation is made, and the government has said affected organisations will get time to adjust.
Does the Cyber Security and Resilience Bill apply to small businesses?
Most small businesses are not directly regulated. The Bill covers operators of essential services, data centres, large load controllers, and medium and large managed and digital service providers. A small business can still be designated as a critical supplier if it supplies a regulated organisation and a disruption would have a significant impact on the UK.
Which IT providers are covered by the Bill?
Managed service providers that provide ongoing management of IT systems for UK customers, such as remote monitoring, backups or firewall management, unless they are a small or micro enterprise. The Bill uses the EU definition, under which a small enterprise has fewer than 50 staff and turnover or balance sheet of no more than 10 million euros.
How quickly will incidents have to be reported?
In-scope organisations will have to send a short initial notification within 24 hours of becoming aware of a significant incident, and a full report within 72 hours. Managed service providers will also have to identify customers likely to have been affected and tell them.
Who will regulate managed service providers?
The Information Commission, the body formerly known as the ICO. In-scope providers will have to register with it, and it will be able to inspect, enforce and fine.
What are the fines under the Bill?
Up to 17 million pounds or 4% of worldwide turnover, whichever is higher, for the more serious breaches, and up to 10 million pounds or 2% of worldwide turnover for less serious ones. Regulators decide the actual amount within those limits.
Sources
- UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill, bill page and current version (as amended in Grand Committee, 7 September 2026)
- GOV.UK: Summary of the Bill, factsheet updated 30 June 2026
- GOV.UK: Relevant managed service providers, factsheet updated 30 June 2026
- GOV.UK: Incident reporting, factsheet updated 30 June 2026
- GOV.UK: Enforcement, factsheet updated 30 June 2026
- GOV.UK: Designating critical suppliers
- DSIT: Cyber Security and Resilience Policy Statement, April 2025
- The Network and Information Systems Regulations 2018, regulation 1
- NCSC: Cyber Action Toolkit announcement
- NCSC: Early Warning
This guide explains the Bill as it stood in October 2026. It is general information, not legal advice.
Free • 12 minutes • Written PDF report
Who actually holds the keys to your systems?
List the systems your business runs, answer plain-English questions about how they are controlled, and get a report with a red, amber and green rating for every area and what to fix first. Nothing on your systems is touched.
Cyber Essentials certified · Microsoft Partner · rated 5.0 on Google