Cyber Security and Resilience Bill:what is changing
Published
The UK's update to the NIS Regulations is going through the House of Lords. It brings managed service providers into scope and introduces 24-hour incident reporting.
The Cyber Security and Resilience Bill was introduced to Parliament on 12 November 2025. It reforms and adds to the Network and Information Systems (NIS) Regulations 2018, which cover essential services such as energy, water, transport and health. The House of Lords reached its report stage on 20 October 2026. It isn't law yet, and the details can still change.
What is changing
- Managed service providers: medium and large MSPs that meet the definition of a relevant managed service provider come into scope. They will have to register with the Information Commission (formerly the ICO), take appropriate and proportionate security measures and report significant incidents.
- Faster reporting: a short initial notification within 24 hours and a full report within 72 hours, with the NCSC told at the same time as the regulator. Incidents such as ransomware and pre-positioning have to be reported if they are likely to have a significant impact, even before they do.
- Telling customers: data centres and relevant managed and digital service providers will have to tell customers about breaches that have likely affected them.
- Critical suppliers: the Bill also lets regulators designate critical suppliers, as set out in the government's factsheets.
What to do now
- If you are an MSP, check whether you would meet the definition, and start preparing to register, document your security measures and report incidents.
- If you use an MSP, ask how and how quickly they would tell you about a breach that affects you.
- Rehearse a 24-hour report: know who decides an incident is significant and who contacts the regulator. Our Incident Response and Risk, Compliance & vCISO services can help.