Insights and analysis on the Cyber Security and Resilience Bill.
Expert guidance on the Cyber Security and Resilience Bill. Stay informed with the latest compliance updates, implementation strategies, and regulatory insights.
Every update on the Bill, newest first.
Parliamentary progress, analysis of what each change means, and practical guidance for organisations in scope.
UK Cyber Breaches Survey 2026: The Cyber Security and Resilience Bill Compliance Gap
DSIT's Cyber Security Breaches Survey 2025/2026 put 43% of UK businesses on the wrong end of a breach. The more revealing numbers sit beneath that headline: only 40% told anyone outside the organisation, and only 25% hold a formal incident response plan. Here is what that gap means once the Cyber Security and Resilience Bill (CSRB) makes 24/72-hour reporting a legal duty.
Read the update →Cyber Security and Resilience Bill: Lords Second Reading Scheduled for 14 July 2026
The House of Lords has fixed 14 July 2026 for its Second Reading of the Cyber Security and Resilience Bill (CSRB), now HL Bill 32, with a dedicated Lords Library briefing published to accompany the debate. Here is what a Lords Second Reading actually does, the reservations peers are most likely to put on the record, and how the remaining stages shape your compliance timeline.
Read the update →Five Eyes AI Warning and the Cyber Security and Resilience Bill: What Boards Must Know
In the same week the Cyber Security and Resilience Bill (CSRB) reached the Lords as HL Bill 32, NCSC CEO Richard Horne told RUSI that 75% of the 200-plus CNI incidents it handled were state-linked - and five days later all five Five Eyes agencies warned that AI is compressing threat timelines to months, not years. Two signals, one message for boards: the case for the CSRB is now on the public record, and preparation cannot wait for Royal Assent.
Read the update →Cyber Security and Resilience Bill Clears the Commons: Where It Stands in 2026
The Cyber Security and Resilience Bill (CSRB) has cleared every House of Commons stage and passed to the Lords as HL Bill 32. The core architecture survived intact - expanded scope, 24/72-hour reporting, £17m penalties - with one headline change: Ofcom is now the sole regulator for data centres. Here is the confirmed timeline and what to do before Royal Assent, expected late 2026.
Read the update →The Cyber Security and Resilience Bill 2026: A Definitive Analysis
The Cyber Security and Resilience Bill (CSRB), which replaces the NIS Regulations 2018, is now through Second Reading, and its four shifts - expanded scope, two-stage reporting, cost recovery and direct supply chain intervention - land on organisations that have never been regulated before. A full analysis of the RMSP and critical supplier definitions, the near miss clause, the 14 principles of the Software Security Code of Practice, and the penalty tiers.
Read the update →The Cyber Security and Resilience Bill: January 2026 Update & Strategic Analysis
The Cyber Security and Resilience Bill (CSRB), Bill 329, passed its Second Reading on 6 January 2026, and the same day the Government announced a £210m Cyber Action Plan for the public sector it has left outside the Bill. For everyone else the direction is set: the Section 9 RMSP designation, a statutory 24-hour clock that most 9-5 IT teams cannot meet, and cost recovery from the victim organisation.
Read the update →Cyber Security and Resilience Bill Introduced to Parliament: Key Changes and What to Expect
The Cyber Security and Resilience Bill (CSRB), Bill 329, was formally introduced to Parliament on 12th November 2025: 61 sections across 5 Parts and 2 Schedules, and the most substantial update to UK cyber security law since the NIS Regulations 2018. This is the section-by-section walkthrough - who the expanded scope catches, exactly what the 24 and 72-hour notifications must contain, and which provisions bite on Royal Assent.
Read the update →What is the UK Cyber Security and Resilience Bill (CSRB) and Why Should You Care?
The UK Cyber Security and Resilience Bill (CSRB) is the biggest shake-up of UK cyber legislation in years: 5 Parts, 61 sections, and a shift that turns resilience from good practice into a legal obligation. This is the plain-English starting point - who it catches, what it demands, what non-compliance costs, and the three things to do about it now.
Read the update →Know where you stand before the duties land.
Take the free readiness assessment to see how your organisation measures up against the Cyber Security and Resilience Bill, or talk to our team about a plan.