The Cyber Security and Resilience Bill will bring medium and large managed service providers into the UK’s NIS regulations for the first time, with a 24 hour incident reporting deadline. If an MSP runs your IT, those duties will shape your contracts, your supplier questionnaires and the first day of any breach, whether or not you are regulated yourself.
That is the part most coverage misses. The Bill is written for essential services, data centres and IT providers, so if you run a law firm, a charity, a property business or a mid-market finance team it is easy to file under somebody else’s problem.
It arrives on your desk anyway, through the supplier who holds the keys to your systems. Transputec expects to be regulated under it, so what follows comes from working through that preparation rather than reading about it.
This Bill regulates your IT provider rather than you, and that is precisely why it ends up on your desk: their 24 hour clock only runs if your contracts, contacts and access arrangements let it.
Where the Cyber Security and Resilience Bill Stands Today
The full name is the Cyber Security and Resilience (Network and Information Systems) Bill. It has passed the House of Commons and completed Committee stage in the House of Lords on 7 September 2026. Report stage in the Lords is scheduled for 26 October 2026, though Parliament flags future dates as provisional.
Report stage matters because it is the first point in the Lords where amendments can be put to a vote of the whole House. The text can still change, and the Committee stage showed how narrow that change tends to be: of 193 amendments tabled, five were agreed, all of them government amendments. Peers will work from the reprinted Bill as amended in Grand Committee rather than the version that went in.
The point for planning is simpler. The Cyber Security and Resilience Bill is not law yet. Even after Royal Assent, the measures that affect businesses most, including MSP regulation, incident reporting and critical supplier designation, get switched on later through secondary legislation, after consultation and with an adjustment period.
Nobody can give you a firm date for when the duties bite, and anyone who does is guessing. Royal Assent is one milestone, commencement regulations are another, and the consultation on the detail sits between them. The sequence matters more than the calendar: the obligations arrive in stages, the hardest ones for providers come with the reporting thresholds, and those thresholds are the piece still to be written.
That gives you a window. It is not a reason to wait, because none of the preparation below depends on the final wording.
What the Bill Actually Does
The Cyber Security and Resilience Bill updates the Network and Information Systems Regulations 2018, which is the UK’s only cross-sector cyber security law. Today those regulations cover operators of essential services in energy, transport, health, drinking water and digital infrastructure, plus some digital services such as online marketplaces, search engines and cloud computing.
The government’s case is that the regime has fallen behind the threat. The National Cyber Security Centre handled 429 incidents in the year to August 2025, of which 204 were nationally significant. The equivalent figure the year before was 89, so that category more than doubled.
Three things change. Scope widens to bring in data centres, managed service providers, large load controllers and designated critical suppliers. Regulators get faster and broader incident reporting, cost recovery, information sharing and stronger enforcement. And the government takes powers to update the regime later through secondary legislation.
Who answers to whom is worth having straight, because it is not one regulator.
| Newly in scope | Regulator | What it means in practice |
|---|---|---|
| Medium and large managed service providers | The Information Commission | Registration, security duties and the two stage reporting clock |
| Medium and large data centres | Ofcom | Brought in as critical national infrastructure in their own right |
| Large load controllers | Energy regulators | Covers control of significant electrical load, including charging infrastructure |
| Designated critical suppliers | The relevant sector regulator | Applied case by case, and only a very small number are expected |
One naming point that trips people up. The Information Commissioner’s office was abolished by the Data (Use and Access) Act 2025, and the Information Commission took over on 30 September 2026. It still trades as the ICO, which now stands for the Information Commission’s Office.
Penalties rise as well. For the most serious breaches the maximum becomes 17 million pounds or 4% of worldwide turnover, whichever is higher. A lower tier of 10 million pounds or 2% applies to failures such as registration and providing information.
Not sure how exposed your supplier arrangements are
Transputec offers a free Cyber Health Check, a short review of where your security currently stands, including the supplier access and incident contacts this Bill will put under pressure.
Get a Strategic ConsultationWho Is in Scope, and Who Is Not
The regime still will not cover every organisation. Directly regulated entities will include the existing operators of essential services and relevant digital service providers, plus the four new categories in the table above.
The definition that matters to most readers is the relevant managed service provider, or RMSP. The government defines that as anyone providing managed services in the UK, whether or not they are established here, that is not a small or micro enterprise. A managed service means ongoing management of a customer’s IT systems under contract, delivered by connecting to or accessing those systems.
That captures IT helpdesks and remote support, management of email, applications and infrastructure, and managed security services such as a security operations centre. Legal analysis published on Lexology estimates that 900 to 1,100 providers will come into the net.
Three groups sit outside it: installers who do the job and leave with no ongoing management, software vendors selling a product rather than running it, and professional advisers.
So if you are a law firm, charity, property company, media business or mid-market financial firm, you are probably not regulated directly. That is the point of this article.
What Changes for Your IT Provider
An RMSP will have four duties, and each one has a consequence you will feel.
It must register with the Information Commission within three months of the rules commencing. It must appoint a UK representative if it is based overseas. It must take appropriate and proportionate measures to manage risks to the systems it uses to deliver managed services. And it must report significant incidents to the regulator.
Read that third duty carefully, because it covers the systems the provider uses to deliver the service, not only the systems it sells you. The remote management tooling that reaches into hundreds of client networks is exactly the asset the Bill is aimed at, and it is the one that has been attacked repeatedly in supply chain compromises elsewhere.
Registration is more consequential than it sounds. A public register of regulated providers gives buyers a list to check against, and it gives regulators somewhere to start when an incident crosses several clients at once. For providers based outside the UK, the requirement to appoint a UK representative is the part most likely to be underestimated, because it means a named accountable presence here rather than a support rota somewhere else.
None of this is free for the provider, which is the honest part nobody writes down. Registration, a UK representative, evidenced security controls and a tested reporting process all cost money, and some of that will arrive in your renewal.
The 24 Hour and 72 Hour Clock
MSP incident reporting under the Cyber Security and Resilience Bill runs in two stages.
A light initial notification goes to the regulator within 24 hours of the provider becoming aware of a significant incident, and the NCSC sees it at the same time. That first notice needs only the entity’s name, the service affected and brief details. A fuller report follows within 72 hours, covering when the incident happened, whether it is ongoing, its nature, whether it was caused by an incident at another regulated entity, and its impact.
The threshold moves as well, and this is the change with the most practical bite. Under today’s regulations an incident generally has to have disrupted a service before it is reportable. Under the Bill, incidents that have, or are likely to have, a significant impact must be reported. That catches ransomware and pre-positioning before the damage lands.
What counts as significant has not been settled. The thresholds will be set in secondary legislation, and for providers the factors are expected to include the effect on customers’ own networks and systems rather than only on the provider. That is an unusual test, because it asks a supplier to assess harm landing somewhere it cannot fully see, which is another reason the contractual plumbing below matters.
Then comes the part aimed squarely at you. After the full report, the provider must work out which customers are likely to have been affected and tell them, with details of the incident and why it believes they are affected.
On paper that is good news for clients. It is only good news if your organisation can receive that notice out of hours and act on it, which is a question about your incident response plan rather than about the Bill.
How It Reaches Firms That Are Not Regulated
The Cyber Security and Resilience Bill reaches an unregulated firm by four routes, three written into the legislation and one that is simply how markets behave.
Through your provider. A 24 hour deadline is only achievable if the contract, the contacts and the access arrangements support it. Expect MSPs to tighten terms: incident notification clauses, named emergency contacts, controls on privileged and third party access, evidence of multi-factor authentication, and a clearer split of who is responsible for what.
Through your regulated customers. The Bill lets the government set stronger supply chain duties for regulated organisations through secondary legislation, subject to consultation. If you supply an energy company, an NHS body, a data centre or a digital service provider, their requirements will flow down to you as questionnaires, certification demands and audit rights.
Through designation as a critical supplier. Regulators will be able to designate a supplier as critical where it supplies a regulated entity, depends on network and information systems to do so, and an incident could cause significant disruption to the economy or society. Designated suppliers face statutory duties, inspection and fines, though the requirements will be no tougher than those on regulated entities. Only a very small number are expected to be designated.
Through the market. This last one is our reading rather than the law. Once your provider, your largest customers and your European partners all work to the same standards, those standards become what boards, insurers and buyers expect. It is already happening through NIS2, which reaches UK firms through their EU customers’ contracts.
What to Do Before the Rules Commence
None of this depends on the final wording, which is why it is worth starting now.
- Map your providers. List every supplier with ongoing access to your systems. Most organisations find more than they expected.
- Ask each one directly whether they expect to be an RMSP, and how they will meet the 24 and 72 hour deadlines.
- Review contracts for incident notification timelines, customer notification, audit rights, sub-processor controls and exit arrangements. The clause worth adding if it is missing is a commitment to tell you when the provider believes you are affected, within a stated time, rather than when the investigation concludes. Those are very different dates.
- Name your contacts. Keep a 24 hour contact list your provider holds and has actually tested, including out-of-hours deputies.
- Rehearse a supplier incident so that a notification triggers triage, containment, legal review and board escalation rather than a scramble.
- Lock down privileged access. Multi-factor authentication, just-in-time admin rights and logging on every account a supplier uses.
- Get the basics certified. Cyber Essentials or Cyber Essentials Plus is the floor most buyers now ask for.
- Test recovery. Prove you can restore critical systems from clean backups inside your target time.
Two of those are worth doing even if the Bill were abandoned tomorrow. A tested out-of-hours contact list and enforced multi-factor authentication on supplier accounts are the two controls that most often decide whether a supplier incident becomes your incident, and neither needs a budget line or a regulator to justify it.
If you want a view of where you stand before doing any of it, a cyber health check is the cheapest way to get one.
How Transputec Is Preparing
Transputec is an independent London managed IT and cyber security provider, and we expect to fall in scope of the Cyber Security and Resilience Bill as a managed service provider. We are preparing our own operations for registration, the security duties and the reporting regime, which means the advice here comes from working through it rather than reading about it.
What that gives clients is fairly practical. We hold ISO 27001 and Cyber Essentials Plus and sit on the G-Cloud 15 framework, so the evidence buyers ask for already exists and is published. A 24/7 UK security operations centre covers detection, containment and incident response, which is the capability the reporting clock actually depends on. And our managed IT runs to experience level agreements, so what gets measured is how IT feels to your people rather than how quickly tickets close.
We are not a law firm and this is not legal advice. For a formal view on whether your organisation falls in scope, speak to your legal adviser. Our work is the security and operational side that makes compliance achievable once somebody has answered that question.
The Short Version
The Cyber Security and Resilience Bill is aimed at essential services, data centres and IT providers, and its effects will reach a long way past them. Your provider will be on a 24 hour clock. Your regulated customers will push their requirements down the chain. Supply chain security will become a standard part of how buyers judge you.
The organisations that cope best will not be the ones that read the Act first. They will be the ones that tidied up contracts, contacts and privileged access before the secondary legislation arrived, because all of that is useful whatever the final text says.
Transputec’s cyber incident response team can talk you through the security work behind supplier incident readiness, from access controls to tested escalation paths.
FAQs
Has the Cyber Security and Resilience Bill become law?
Not yet. As of October 2026 it is in the House of Lords, with Report stage scheduled for 26 October 2026, and Parliament treats future dates as provisional. After Royal Assent, most of the duties that affect businesses will come into force later through secondary legislation, following consultation and with an adjustment period.
Does it apply to my business if we are not an MSP?
Probably not directly, unless you already fall under the NIS regulations or a regulator designates you as a critical supplier. You will still feel it through your provider’s contract terms, through the supplier requirements your regulated customers pass down, and through what buyers and insurers come to treat as the baseline. The practical test is simple. If your largest customer is regulated, or somebody else runs your IT, assume the effects reach you and plan on that basis. Nothing in that preparation is wasted if the final text shifts, because it is ordinary supplier hygiene.
What are the MSP incident reporting deadlines?
Under the Bill, a relevant managed service provider must send an initial notification within 24 hours of becoming aware of a significant incident, and a fuller report within 72 hours. Both go to the Information Commission, with the NCSC informed at the same time. The provider must then notify the customers it believes are likely to have been affected.
How does the Bill relate to the NIS regulations and NIS2?
The Cyber Security and Resilience Bill amends the UK’s own NIS Regulations 2018. NIS2 is separate EU law that does not bind UK-only businesses, although it reaches many UK firms through contracts with EU customers. The two-stage 24 and 72 hour reporting model in the Bill closely mirrors the NIS2 approach, which is useful if you already answer NIS2 questions for a European client.
What should we do now?
Map every provider with ongoing access to your systems, ask each whether they expect to be in scope, review contracts for notification timelines and audit rights, keep a tested out-of-hours contact list, enforce multi-factor authentication on supplier access, and confirm your Cyber Essentials position. Transputec can review any of this as part of a cyber health check.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
