What is the Cyber Security and Resilience Bill?
The UK's biggest update to cyber security legislation in over a decade. Learn what it means, who it affects, and how to prepare your organisation.
The Cyber Security and Resilience Bill is the UK's landmark legislation to modernise cyber security regulation. Introduced to Parliament in November 2025 as Bill 329, it significantly expands the scope of the existing NIS Regulations 2018 to cover managed service providers, data centres, cloud platforms, and critical suppliers for the first time. The Bill introduces mandatory 24-hour incident reporting, strengthens supply chain security requirements, grants the Secretary of State new powers to set strategic priorities and issue national security directions, and raises maximum penalties to the greater of £17 million or 4% of global turnover. Now before the House of Lords as HL Bill 49, with Royal Assent expected between late 2026 and spring 2027, the CSRB represents the UK's most comprehensive update to cyber security law in over a decade.
What is the Cyber Security and Resilience Bill?
The Cyber Security and Resilience (Network and Information Systems) Bill (Bill 329) was introduced to Parliament on 12th November 2025. It passed all of its House of Commons stages and is now before the House of Lords (HL Bill 49, reprinted after Committee Stage), where Second Reading was completed on 14 July 2026 and Committee Stage sat on 1, 3 and 7 September 2026, with Royal Assent expected between late 2026 and spring 2027. This legislation marks the UK's most comprehensive update to cyber legislation in over a decade, significantly expanding the scope of existing NIS Regulations 2018. The Bill is structured in 5 Parts with 61 sections and 2 Schedules, creating comprehensive regulatory frameworks for managed service providers, cloud platforms, data centres, and critical suppliers.
Part 2 amends the NIS Regulations to bring new entities into scope. Part 3 grants the Secretary of State powers to set strategic priorities and make regulations. Part 4 introduces national security directions. Organisations delivering essential or digital services must proactively manage cyber risk throughout their supply chains. Failing to comply may result in financial penalties of up to the greater of £17,000,000 and 4% of global turnover (Section 21), with a standard maximum of the greater of £10,000,000 and 2% of turnover for registration and information-provision failures. Part 4 national security directions are enforced separately under Section 49, where contravening a direction carries a maximum of £17,000,000, rising to the greater of £17,000,000 and 10% of turnover only once regulations under Section 49(5) are in force, plus up to £100,000 per day while the contravention continues. Neither applies under the NIS Regulations.
Where the Bill stands today
Current stage
House of Lords - HL Bill 49 (Committee completed 7 September 2026)
Lords Committee Stage
Completed - sat 1, 3 and 7 September 2026
Lords Report Stage
Scheduled for 26 October 2026 (HL Bill 49)
Royal Assent
Expected late 2026 to spring 2027
Full implementation
Phased to ~2028 via secondary legislation
The Bill cleared all House of Commons stages (Second Reading 6 January 2026; Committee 3-24 February; Report and Third Reading 16 June 2026, passed without division) and is now before the House of Lords. The Lords completed their Second Reading on 14 July 2026 with cross-party support in principle. Lords Committee Stage sat in Grand Committee across three days (1, 3 and 7 September 2026), where only 5 of 193 amendments were agreed. The Government tabled new vendor-related direction powers over risky technology suppliers but did not move them, and resisted amendments on AI scope, an AI kill switch and Computer Misuse Act reform. The Bill was reprinted as HL Bill 49. Lords Report Stage is scheduled for 26 October 2026, when amendments withdrawn in committee can be brought back and pressed to a vote, followed by Third Reading. A key earlier committee change made Ofcom the sole regulator for data centres. Royal Assent is expected between late 2026 and spring 2027, with full effect not expected until around 2028 via secondary legislation following the Government's 2026 implementation consultation.
Expanded Scope (Part 2)
Section 9: MSPs as RMSPs. Section 4: Data centres (1MW/10MW thresholds). Section 6: Load controllers (300MW+). Section 12: Critical suppliers.
Strategic Priorities (Part 3)
Section 25: Statement of Strategic Priorities. Section 36: Codes of Practice. Section 29: Regulations on security and resilience.
Incident Reporting (Section 15)
24-hour initial notification, 72-hour full report. Section 16: Customer notification required. Must copy CSIRT.
Supply Chain Security (Section 12)
Regulation 14H: Critical supplier designation. Section 30: Activity-critical supply requirements.
Enforcement (Part 2, Chapter 3)
Section 21: higher maximum the greater of £17M and 4% turnover; standard maximum the greater of £10M and 2%. Section 20: Information gathering. Schedule 1: Inspection powers.
National Security (Part 4)
Section 43: Directions to regulated persons. Section 49: Penalties of up to £100K/day for continuing contravention of a direction (Part 4 only). Section 47: Inspection powers.
Why is the Cyber Security and Resilience Bill Being Introduced?
Digital Dependency & Rising Threats
The UK's digital economy has grown exponentially, but so has our vulnerability to cyber attacks. Recent high-profile incidents targeting critical infrastructure have exposed gaps in our current regulatory framework.
The Cyber Security and Resilience Bill addresses these challenges by extending regulatory oversight to previously unregulated sectors and strengthening requirements for existing ones.
Key Drivers for the Cyber Security and Resilience Bill
- Increasing sophistication of cyber threats
- Growth in critical digital services and dependencies
- Regulatory gaps in current NIS legislation
- Need for stronger supply chain security
Who Does the Cyber Security and Resilience Bill Apply To?
Part 2, Chapter 1 of HL Bill 32 significantly expands the scope of cybersecurity regulation beyond traditional critical infrastructure. Section 9 brings MSPs into scope, Section 4 designates data centres, Section 6 covers load controllers, and Section 12 enables critical supplier designation.
Managed Service Providers
Section 9: RMSPs - ongoing IT management services. Must register within 3 months (Section 14).
Cloud Service Providers
Section 7: RDSPs providing cloud computing services. Excludes managed services.
Data Centres
Section 4: Essential services. Thresholds: 1MW (general) or 10MW (enterprise-only).
Critical Suppliers
Section 12: Can be designated if failure impacts national infrastructure. Includes SMEs.
Bill Structure
HL Bill 32 is organised into 5 Parts with 61 sections and 2 Schedules, creating a comprehensive regulatory framework.
Introduction
Sections 1-2: Definitions and overview of the Act
- • Section 1: Meaning of "NIS Regulations"
- • Section 2: Overview of Act structure
The NIS Regulations
Sections 3-23: Amendments to NIS Regulations 2018
- • Chapter 1: Regulated persons (Sections 3-12)
- • Chapter 2: Information & reporting (Sections 13-16)
- • Chapter 3: Other amendments (Sections 17-23)
Security & Resilience Functions
Sections 24-42: Secretary of State powers
- • Chapter 2: Strategic priorities (Sections 25-28)
- • Chapter 3: Regulations (Sections 29-35)
- • Chapter 4: Code of practice (Sections 36-39)
National Security Directions
Sections 43-58: Emergency powers
- • Section 43: Directions to regulated persons
- • Section 49: Penalties of up to £100K/day for contravening a direction
- • Section 47: Inspection powers
General
Sections 59-61: Extent, commencement, short title
- • Section 60: Phased commencement
- • Section 61: Short title - Act 2026
Enforcement & Amendments
2 Schedules with detailed provisions
- • Schedule 1: Enforcement and appeals
- • Schedule 2: Minor and consequential amendments
Key Changes
The Cyber Security and Resilience Bill introduces several major reforms to the UK's cybersecurity landscape. Here's what you need to know:
Bringing More Organisations Into the Frame
Part 2, Chapter 1 of the Bill significantly expands who must comply with cyber regulations. Section 9 brings Managed Service Providers (MSPs) into scope as 'Relevant Managed Service Providers' (RMSPs), subject to security duties under Section 10. Section 4 designates data centres as essential services with thresholds of 1MW (general) or 10MW (enterprise-only). Section 6 brings large load controllers (300MW+) into scope. Section 12 allows designation of critical suppliers. These changes close major gaps in the UK's cyber defence chain, bringing hundreds of previously unregulated entities under oversight.
Need help preparing?
Our compliance team can guide you through the new requirements
Talk to our compliance teamBringing More Organisations Into the Frame
Part 2, Chapter 1 of the Bill significantly expands who must comply with cyber regulations. Section 9 brings Managed Service Providers (MSPs) into scope as 'Relevant Managed Service Providers' (RMSPs), subject to security duties under Section 10. Section 4 designates data centres as essential services with thresholds of 1MW (general) or 10MW (enterprise-only). Section 6 brings large load controllers (300MW+) into scope. Section 12 allows designation of critical suppliers. These changes close major gaps in the UK's cyber defence chain, bringing hundreds of previously unregulated entities under oversight.
Need help preparing for these changes?
Our compliance team can guide you through the new requirements
Official Sources
Everything on this page is drawn from the primary sources below. We link to them directly so you can verify any detail against the official record.
- Bill stages and publications - UK Parliament
The authoritative record of the Bill’s progress, amendments and committee reports.
- Cyber Security and Resilience Bill collection - GOV.UK
DSIT policy statement, factsheets and the impact assessment.
- HL Bill 32 briefing (LLN-2026-0032) - House of Lords Library
Independent briefing prepared for the Lords Second Reading debate.
- Research briefing CBP-10442 - House of Commons Library
Clause-by-clause analysis of the Bill and its Commons passage.
- NIS Regulations 2018 - legislation.gov.uk
The regulations this Bill amends.
- Cyber Assessment Framework - NCSC
The framework regulators are expected to use to assess compliance.