What is the Cyber Security and Resilience Bill?

The Cyber Security and Resilience (Network and Information Systems) Bill (Bill 329) was introduced to Parliament on 12th November 2025. It passed all of its House of Commons stages and is now before the House of Lords (HL Bill 32), where Second Reading was completed on 14 July 2026 and Committee Stage is scheduled for 1 September 2026, with Royal Assent expected in late 2026. This legislation marks the UK's most comprehensive update to cyber legislation in over a decade, significantly expanding the scope of existing NIS Regulations 2018. The Bill is structured in 5 Parts with 61 sections and 2 Schedules, creating comprehensive regulatory frameworks for managed service providers, cloud platforms, data centres, and critical suppliers.

Part 2 amends the NIS Regulations to bring new entities into scope. Part 3 grants the Secretary of State powers to set strategic priorities and make regulations. Part 4 introduces national security directions. Organisations delivering essential or digital services must proactively manage cyber risk throughout their supply chains. Failing to comply may result in financial penalties of up to the greater of £17,000,000 and 4% of global turnover (Section 21), with a standard maximum of the greater of £10,000,000 and 2% of turnover for registration and information-provision failures. Part 4 national security directions are enforced separately under Section 49, where contravening a direction carries a maximum of £17,000,000, rising to the greater of £17,000,000 and 10% of turnover only once regulations under Section 49(5) are in force, plus up to £100,000 per day while the contravention continues. Neither applies under the NIS Regulations.