UK Cyber Security and Resilience Bill: What Businesses and Their Suppliers Need to Know

The UK Government is progressing legislation that could significantly change how cyber security and resilience are regulated across parts of the UK economy. The Cyber Security and Resilience (Network and Information Systems) Bill proposes reforms to the existing Network and Information Systems (NIS) Regulations 2018, including bringing additional organisations and critical parts of supply chains into scope.

The Bill completed its Third Reading in the House of Lords on 2 November 2026 and has now returned to the House of Commons for consideration of amendments made by the Lords. It has not yet received Royal Assent and is therefore not law.

For businesses, the direction of travel is becoming clearer. Organisations providing essential services, managed IT services and data centre services, as well as suppliers supporting critical operations, should pay attention to the proposals and consider how prepared they are to manage cyber security risks.

The Cyber Security and Resilience Bill is intended to strengthen the UK's cyber security framework by reforming and extending the NIS Regulations 2018.

The existing NIS Regulations place security and incident reporting duties on organisations providing certain essential services and relevant digital services. These include sectors such as energy, transport, health, drinking water and digital infrastructure, alongside some digital service providers.

However, the current framework does not cover every organisation or service that could have a significant impact on the UK's essential services and wider economy if disrupted.

The Government's proposed reforms aim to address some of these gaps by expanding the regulatory framework, strengthening incident reporting and giving regulators and the Government additional powers.

The proposals are particularly relevant to organisations whose services are relied upon by essential service providers, even where those organisations may not traditionally have considered themselves part of critical national infrastructure.

The House of Lords completed its examination of the Bill at Third Reading on 2 November 2026.

Four Government amendments were agreed at this stage. These were primarily technical changes intended to improve consistency and clarify the wording of the legislation. Among the changes were references to data centre services rather than data centres and clarification of the provisions defining who may be treated as a regulated person.

The Bill was then passed back to the House of Commons with amendments.

The Commons must now consider the Lords' changes. If the two Houses agree on the final wording, the Bill can proceed towards Royal Assent. If they disagree, further consideration may be required.

Until the Bill has completed its parliamentary passage and received Royal Assent, its proposed new duties should not be treated as law.

Even after Royal Assent, not every measure is expected to take effect immediately. The Government has indicated that implementation will be phased, with some provisions requiring further secondary legislation and additional detail before organisations can be expected to comply.

Businesses should therefore monitor both the Bill's remaining parliamentary stages and the subsequent regulations and guidance.

One of the most significant aspects of the Bill is its proposed expansion of the organisations covered by the NIS framework.

The Government has identified several areas where additional regulation is intended to strengthen the resilience of essential and digital services.

Data centres provide infrastructure that supports a wide range of business and public services, including cloud platforms, financial systems, communications and healthcare services.

The Bill proposes bringing qualifying data centre services into the NIS framework. The Government's intention is to ensure that relevant providers have appropriate and proportionate measures in place to manage risks to the network and information systems on which their services depend.

The detail of which services and providers will be covered, including relevant thresholds and regulatory requirements, will depend on the final legislation and supporting regulations.

Managed service providers (MSPs) can have extensive access to customers' IT environments, networks and systems. This can make them an attractive target for cyber criminals and a potential route into multiple organisations.

The Bill proposes bringing qualifying relevant managed service providers (RMSPs) into the regulatory framework. This is particularly important for businesses that outsource IT management, infrastructure support or cyber security services.

However, not every IT support company or MSP will automatically fall within scope. The definition of a relevant managed service provider and the criteria used to determine which organisations are covered will be important.

Businesses providing managed services should follow the development of these requirements closely. Organisations that depend on external IT providers should also consider the security and resilience of those relationships.

The proposals also include large load controllers, which manage electrical demand through connected devices and systems.

These services can play a role in balancing electricity demand, including through the management of smart appliances and electric vehicle charging. A cyber incident affecting relevant systems could have implications beyond the organisation operating them.

The Bill proposes bringing qualifying large load controllers into the NIS framework, with further detail expected through the supporting regulatory process.

The Bill also proposes giving regulators powers to designate certain suppliers as critical to the organisations and services covered by the NIS regime.

This recognises that disruption to an essential service may originate within its supply chain. A supplier providing an important technology, service or operational function could create significant consequences if its systems were compromised or unavailable.

Designation would not automatically apply to every supplier working with an essential service provider. Regulators would have powers to identify suppliers that meet the relevant criteria.

For businesses supplying organisations in regulated sectors, this is an important development. Cyber security expectations may increasingly extend beyond the organisation directly responsible for delivering an essential service.

The Bill proposes changes to how cyber security incidents are reported.

Under the existing NIS framework, reporting obligations focus on incidents that have a significant impact on the continuity of essential or digital services.

The proposed reforms would broaden the types of incidents that need to be reported, including certain harmful incidents that have the potential to cause significant impacts, even where disruption has not yet occurred.

The Government's published proposals include:

• An initial notification to the relevant regulator within 24 hours.
• A more detailed report within 72 hours.
• Notification to the National Cyber Security Centre at the same time.
• Requirements for relevant data centre and digital or managed service providers to inform customers where they are likely to have been affected.

These proposed timescales and obligations will be subject to the final legislative provisions and supporting regulations. Businesses should not assume that the new reporting deadlines already apply to them.

The Bill also proposes stronger regulatory powers, improved information sharing and changes to enforcement and cost recovery. These measures are intended to support more consistent oversight across the sectors covered by the NIS framework.

The proposed expansion of the NIS framework has implications beyond organisations that will be directly regulated.

A business may not itself provide an essential service, operate a data centre or qualify as a relevant managed service provider. However, it may supply software, IT support, infrastructure, professional services or other products that an organisation in scope depends on.

If a supplier's systems or services are important to the continuity of a regulated organisation, its cyber security arrangements may receive greater scrutiny.

Customers may seek more evidence of how suppliers identify and manage information security risks, control access to systems, manage incidents and maintain business continuity.

For suppliers, this could influence procurement requirements, contract renewals and tender assessments. Demonstrating a structured approach to information security may become increasingly important when competing for contracts with organisations that have regulatory responsibilities.

Businesses should consider:

• Which customers and sectors depend on their services.
• Whether their products or services support essential or regulated operations.
• How cyber security responsibilities are defined in customer and supplier contracts.
• Whether incident reporting and escalation arrangements are sufficiently clear.
• How access to customer systems and sensitive information is controlled.
• What evidence they can provide to demonstrate their information security arrangements.

These are sensible considerations regardless of whether a business is ultimately brought within the expanded regulatory scope.

As organisations review their cyber security arrangements, ISO/IEC 27001 may be relevant.

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It provides a framework for establishing, implementing, maintaining and continually improving a systematic approach to managing information security risks.

An ISMS covers more than technical security controls. It includes areas such as leadership, risk assessment, policies, responsibilities, operational controls, monitoring and continual improvement.

For organisations operating in supply chains, ISO 27001 certification can provide independent evidence that their information security management system has been assessed against the requirements of the standard.

This can help demonstrate a structured approach to information security to customers, business partners and procurement teams.

However, ISO 27001 certification should not be confused with compliance with the Cyber Security and Resilience Bill. Certification does not automatically establish that an organisation meets specific legal or regulatory duties. Any organisation brought within the scope of the NIS framework will need to understand and meet the requirements that apply to it.

For businesses seeking to strengthen their information security management and demonstrate their approach to customers, ISO 27001 can nevertheless provide a valuable foundation.

Although the Bill has not yet become law, organisations do not need to wait for every detail to be finalised before reviewing their cyber security arrangements.

A practical starting point is to understand how the proposals could affect the business, its customers and its supply chain.

The Cyber Security and Resilience Bill represents a significant proposed development in the UK's approach to cyber security regulation. Its focus on managed service providers, data centre services and critical suppliers reflects the extent to which essential services now depend on interconnected technology and external organisations.

Although the Bill has completed Third Reading in the House of Lords, it must still complete its parliamentary passage. Further regulations and guidance will also be needed to establish how several of the proposed requirements will operate in practice.

For businesses, the message is clear: cyber security is not simply an internal IT issue. The resilience of suppliers, service providers and wider business relationships can have a direct impact on operational continuity and customer confidence.

Organisations that take a structured approach to information security will be better placed to respond to changing customer expectations and understand the implications of future regulatory requirements.

TÜV UK provides independent, UKAS-accredited certification of Information Security Management Systems against ISO/IEC 27001:2022. Certification provides an independent assessment of an organisation's ISMS against the requirements of the standard.

Find out more about our ISO 27001 certification services