In short: The Cyber Security and Resilience (Network and Information Systems) Bill is a DSIT government bill, introduced on 12 November 2025, that would amend the NIS Regulations 2018. It would regulate medium and large managed service providers, data centres and designated critical suppliers and tighten incident reporting. In late October 2026 it was nearing the end of its House of Lords stages and had not received Royal Assent.
Where the Bill stands (October 2026)
The government published a policy statement on 1 April 2025 and introduced the Bill to the House of Commons on 12 November 2025. Its passage so far, from the Parliament record:
| Stage | Date |
|---|---|
| Commons first reading | 12 November 2025 |
| Commons second reading (with a carry-over motion) | 6 January 2026 |
| Commons committee stage | February 2026 |
| Reintroduced in the new session, then Commons report stage and third reading | 14 May and 16 June 2026 |
| Lords first and second reading | 17 June and 14 July 2026 |
| Lords committee stage | September 2026 |
| Lords report stage | 26 October 2026 |
| Lords third reading | Scheduled for 2 November 2026 |
At the time of writing (29 October 2026) the latest print was the version as amended on Report in the Lords (HL Bill 62). Any Lords amendments still have to be considered by the Commons before the Bill can receive Royal Assent, and it had not received Royal Assent.
Bills can change significantly in their final stages, and most of the detail will come later through secondary legislation after consultation. Check the latest text and stage on the Parliament bill page and the government's Bill collection on gov.uk. We will update this page as it progresses.
Who would be brought into scope
Today the NIS Regulations 2018 cover operators of essential services in energy, transport, health, drinking water and digital infrastructure, plus some digital services such as online marketplaces, search engines and cloud computing services. The government's factsheets describe four new groups:
| New group | What the Bill proposes (paraphrased from the gov.uk factsheets) | Proposed regulator |
|---|---|---|
| Managed service providers | Medium and large providers of ongoing, contracted management of customers' IT systems, such as support, monitoring or administration, through access to customers' networks. Small and micro providers are excluded unless designated as critical suppliers | The Information Commission (formerly the ICO) |
| Data centres | Medium, large and enterprise data centres above set thresholds, in a new data infrastructure sector of essential services | Ofcom |
| Large load controllers | Organisations that manage electrical load from smart appliances, such as electric vehicle charging | DESNZ and Ofgem in Great Britain; the Department of Finance in Northern Ireland |
| Designated critical suppliers | Regulators could designate suppliers whose disruption would seriously affect essential or digital services | The relevant sector regulator |
For managed service providers, the factsheet's in-scope examples include backing up customer data, monitoring systems for security or device health, managing routers, switches and firewalls, and managing a customer's cloud service. Business consultancies, installers with no ongoing management and software vendors are given as out-of-scope examples. Proposed duties include registering with the regulator (with a UK representative for overseas providers), taking appropriate and proportionate measures to manage risks to the systems used to deliver the service, and reporting significant incidents. See Cyber Essentials for MSPs for what this means in practice.
Incident reporting and other changes
The Bill would also change how incidents are reported and how the regime is run:
- Faster reporting. A light-touch initial notification within 24 hours of becoming aware of a significant incident, followed by a fuller report at 72 hours.
- NCSC informed at the same time as the regulator, so it can help with the response.
- Wider definition of a reportable incident, so that harmful breaches such as ransomware and pre-positioning attacks are reported where they are likely to have a significant impact, even before any disruption has happened.
- Customer notification. Data centres, digital service providers and managed service providers would have to identify customers likely to have been affected and tell them.
- Stronger enforcement, with higher maximum penalties, aligned with comparable regimes, and simpler penalty bands.
- Cost recovery, letting regulators recover the costs of their NIS work through charging schemes, while showing how the money is used.
- A statement of strategic priorities from the Secretary of State to make regulation more consistent across sectors.
- Powers of direction so government can require regulators or regulated organisations to act against imminent national security threats.
- Future-proofing powers to add sectors or update security requirements through secondary legislation.
How it relates to Cyber Essentials
The Bill does not make Cyber Essentials a legal requirement, and it does not name a particular standard. Regulated organisations will be expected to take proportionate security measures, with technical detail set out later in regulations and regulator guidance, and the NCSC Cyber Assessment Framework is already the basis for assessing existing NIS operators.
Even so, Cyber Essentials is a sensible first step for any organisation that expects to be regulated, or that supplies one that is:
- It proves the basic technical controls (MFA, patching, secure configuration, malware protection, firewalls) that any proportionate security regime will expect.
- It is something your customers can check independently through IASME's certificate search.
- Cyber Essentials Plus adds technical testing for stronger evidence.
- It sits naturally alongside board-level governance under the Cyber Governance Code of Practice.
How to prepare now
- Work out whether you are likely to fall into a new category, especially if you provide managed IT or security services or run a data centre.
- List the customers and services that depend on you, and the systems you use to reach them.
- Get your own estate to a verified baseline with Cyber Essentials, and consider Cyber Essentials Plus.
- Review your incident response plan against a 24-hour initial notification and a 72-hour full report, and decide how you would tell affected customers.
- Make sure MFA, privileged access and remote administration tools are locked down, because these are the routes attackers use through service providers.
- Follow the consultation on secondary legislation, which the government said it planned for 2026.
Forever Systems can help with the technical side: a gap analysis, remediation and Cyber Essentials certification support alongside an IASME-licensed Certification Body. We do not give legal advice on whether the Bill applies to you. Contact us to discuss your preparation.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Has the Cyber Security and Resilience Bill become law?
Not at the time of writing (29 October 2026). It completed Lords report stage on 26 October 2026, with Lords third reading scheduled for 2 November 2026, and any Lords amendments still need Commons agreement before Royal Assent. Check bills.parliament.uk for the latest stage.
Does the Cyber Security and Resilience Bill apply to managed service providers?
Yes, as proposed. Medium and large providers of managed IT services that connect to or access their customers' systems would be regulated by the Information Commission. Small and micro providers would be excluded unless designated as critical suppliers.
What are the incident reporting timescales in the Bill?
As proposed, an initial notification within 24 hours of becoming aware of a significant incident and a full report within 72 hours, with the NCSC informed at the same time as the regulator.
Will the Bill make Cyber Essentials mandatory?
No. The Bill does not require any particular certification. Cyber Essentials is still a practical way to prove the baseline technical controls that regulators and customers will expect.
When would the new duties start?
Only a few measures, such as the power to update the regime through secondary legislation, would apply from Royal Assent. Most, including the new duties for data centres, managed service providers and large load controllers and the new incident reporting rules, would follow through secondary legislation after consultation, so start dates are not yet fixed. The government said it intended to consult on implementation in 2026.
Who would regulate managed service providers under the Bill?
The Information Commission (formerly the Information Commissioner's Office), according to the government's factsheet. Data centres would be regulated by Ofcom.