Frequently Asked Questions

CSRB FAQ

Find answers to common questions about the Cyber Security and Resilience Bill (Bill 329). All answers reference specific sections and regulations from the legislation.

General Questions

Who is Affected?

Incident Reporting

Registration & Information

Penalties & Enforcement

National Security

Costs & Charges

Appeals & Disputes

Implementation & Compliance

Still Have Questions?

Our cybersecurity compliance experts can help you understand how CSRB affects your organisation and develop a roadmap for compliance.

Talk to Our Experts Take Readiness Assessment

Join Our Mailing List

CSRB FAQ

General Questions

What is the Cyber Security and Resilience Bill (CSRB)?

When does the Cyber Security and Resilience Bill come into effect?

Who is responsible for enforcing the Cyber Security and Resilience Bill?

Who is Affected?

Are Managed Service Providers (MSPs) regulated under CSRB?

Are data centres regulated under CSRB?

What are the thresholds for load controllers?

Can small businesses be designated as critical suppliers?

Are cloud service providers regulated?

Incident Reporting

What are the incident reporting deadlines?

What counts as an "incident" that must be reported?

Do I need to notify customers of incidents?

Registration & Information

What information must I provide when registering?

Do I need a UK representative if I'm based outside the UK?

Can regulators require information from me?

Penalties & Enforcement

What are the maximum penalties under CSRB?

What happens if I don't comply with an enforcement notice?

Can regulators inspect my premises?

National Security

What are national security directions?

How is information shared with GCHQ?

Costs & Charges

Will I have to pay regulatory fees?

Appeals & Disputes

Can I appeal enforcement decisions?

Implementation & Compliance

What security measures must I implement?

How do I prepare for CSRB compliance?

Still Have Questions?