The Cyber Security and Resilience Bill: What Suppliers and Managed Service Providers Should Expect

The Cyber Security and Resilience (Network and Information Systems) Bill is the first major rewrite of the UK’s NIS Regulations 2018, and it is close to the end of its passage: through the Commons on 16 June 2026 and through all its stages in the Lords this autumn, where peers made changes that the Commons must now consider. It is not yet law, and most of its duties will start only when the government makes regulations after Royal Assent. But the shape is settled enough to plan for, and for one group in particular — the suppliers that other organisations depend on — the plan should start now.

Who comes into scope

• Managed service providers. Medium and large providers of managed IT, security and similar services are brought into the regime because of the privileged access they hold to customers’ systems. The government’s factsheet names the Information Commission as their regulator.
• Data centres. Classed as an essential service, with Ofcom as regulator, above size thresholds set in regulations.
• Designated critical suppliers. A regulator will be able to designate a supplier whose failure could disrupt an essential or digital service, and apply duties to it directly — modelled on the critical third parties regime in financial services, and prompted by a 2024 attack on an NHS pathology supplier.
• Large load controllers. Organisations that manage electricity demand for smart appliances such as vehicle chargers, because of the risk to the grid.

What the duties look like

Regulated organisations must take “appropriate and proportionate” measures to manage risks to their systems, on an all-hazards basis. Incident reporting is tightened: a reportable incident includes one that has not yet caused significant disruption, with an initial notification within 24 hours and a fuller report within 72 hours, the National Cyber Security Centre informed at the same time, and customers likely to be affected told by data centres and service providers. Regulators get clearer powers to share information, the ability to recover the full cost of their work from the sector through charging schemes, and a higher maximum penalty, which the government says is aligned with comparable regimes such as the GDPR. The Secretary of State gains a power to set strategic priorities, to bring new sectors into scope by regulations, and to direct regulators and regulated entities against imminent threats to national security.

When

On the government’s published plan, the future-proofing powers start on Royal Assent and the information-sharing provisions two months later; the substantive duties — data centres, managed and digital service providers, load controllers, critical suppliers, incident reporting and cost recovery — follow by secondary legislation, after consultation and with an adjustment period. Its impact assessment puts the annual cost to business at under £150 million. Organisations that also operate in the EU will recognise the pattern from the NIS2 Directive, which has applied there since October 2024.

What to do now

1. Decide whether you are a managed service provider in the Bill’s sense: do you hold privileged, ongoing access to customers’ networks or systems, and are you medium-sized or larger?
2. Map that access: which customers, which systems, which credentials. This is the list a regulator will ask for and the list an attacker is after.
3. Test whether your incident process can produce a meaningful notification within 24 hours, including to customers, and a full report within 72. If your GDPR breach procedure already does this, extend it; if it does not, fix that first — the GDPR’s 72-hour duty applies today.
4. Read your customer contracts for what you have promised about security and notification, and what a critical-supplier designation would add.
5. Fix the basics the regulators keep fining for: unchecked software installs, no real-time monitoring, shared or over-privileged accounts.

Our initial cybersecurity audit is built around that list. We will update this article when the Bill receives Royal Assent and when the commencement regulations are made.