Markus McIver
The Cyber Security and Resilience Bill proposes significant changes to the UK’s existing cyber security regulations, bringing more organisations and suppliers into scope. But even businesses that are not directly regulated could face new expectations from their clients, insurers and technology partners. These FAQs provide clear, practical answers about who may be affected, what the proposed requirements involve and how UK businesses can begin preparing.
1. What is the Cyber Security and Resilience Bill?
The Cyber Security and Resilience Bill is proposed legislation that would strengthen the UK’s rules for protecting essential and digital services from cyber threats.
It would update the existing Network and Information Systems (NIS) Regulations 2018, expanding their scope across the technology supply chain and introducing stronger security, incident-reporting and regulatory requirements.
2. Has the Cyber Security and Resilience Bill been passed?
No. The Bill has passed through the House of Commons and completed its House of Lords Committee stage on 7 September 2026. It must now progress through Report stage, a third reading and consideration of any amendments before it can become law.
If it receives Royal Assent, its requirements will be introduced gradually, with further details and timings to follow. You can track its progress on the UK Parliament website.
3. Is my business directly affected by the Cyber Security and Resilience Bill?
Most UK businesses will not be directly regulated by the Bill. The current NIS Regulations apply to qualifying organisations in essential sectors such as energy, transport, health, drinking water and digital infrastructure, as well as certain cloud services, online marketplaces and search engines.
The Bill would expand these regulations to cover more organisations across the technology and supply chains supporting essential services, including qualifying managed service providers, data centres, large load controllers and suppliers designated as critical.
Whether your business falls directly within scope will depend on the type of service it provides, its size or capacity, and whether it is designated as a critical supplier.
4. Can my business be affected even if it is not directly regulated?
Yes. Businesses outside the Bill’s direct scope could still be affected if they supply or work with regulated organisations.
Regulated customers may introduce stronger cyber security checks, contractual requirements and incident-notification obligations across their supply chains. Businesses may therefore need to provide clearer evidence of their security controls, resilience plans and approach to third-party risk to maintain those relationships.
5. Does the Cyber Security and Resilience Bill affect businesses that outsource IT to an MSP?
Outsourcing IT to an MSP would not automatically bring your business within the scope of the Bill. However, qualifying MSPs would face stronger security, incident-reporting and customer-notification duties.
Your organisation would still be responsible for managing supplier risk, understanding its provider’s security arrangements and preparing to respond if the MSP experiences an incident.
6. Could my business be designated as a critical supplier?
Potentially, but only where specific conditions are met. Your business would need to provide goods or services directly to a regulated organisation and rely on network and information systems to provide them. An incident affecting those systems would also need to have the potential to disrupt the regulated service in a way that could significantly affect the UK economy or the day-to-day functioning of society.
The regulator would assess the risk, consider whether the goods or services could realistically be sourced elsewhere and consult your business before making a designation. A designated critical supplier would then become subject to statutory cyber security requirements.
7. How is the Cyber Security and Resilience Bill different from the current NIS Regulations?
The Bill would expand and strengthen the existing NIS Regulations rather than replace them. It would bring more organisations into scope, broaden incident-reporting requirements and give regulators greater oversight and enforcement powers.
8. What are the penalties for non-compliance?
The Bill would replace the current three-band penalty structure with two bands based on the seriousness of the breach. More serious failures could result in fines of up to £17 million or 4% of worldwide turnover, whichever is higher. Less serious breaches could attract fines of up to £10 million or 2% of worldwide turnover.
9. How can UK businesses prepare for the Cyber Security and Resilience Bill?
Businesses do not need to wait for the Bill to become law to begin preparing. Start by assessing whether your organisation could be directly or indirectly affected, identifying critical technology suppliers and testing whether your incident response procedures can meet the proposed 24-hour and 72-hour reporting deadlines.
Virtuoso can help you understand your exposure, identify security and resilience gaps, and build a practical plan for what comes next. Book a cyber resilience readiness consultation with our team.
Ready to simplify your IT?
Let’s discuss your goals and challenges - no obligation, just practical advice.
Book a Discovery Call
