The Cyber Security and Resilience Bill finished its House of Lords committee stage on 7 September 2026, and Lords report stage is scheduled for 26 October 2026. It is not law yet and it may still be amended. But its shape is now settled enough to plan around, and the biggest change is who it reaches: for the first time, it brings the IT suppliers of essential services into regulation.
Who it reaches that NIS did not
- Managed service providers. A relevant managed service provider is one that provides managed services in the UK, whether or not it is established here, and is not a small or micro enterprise. It must register with the Information Commission, manage its security risks and report significant incidents.
- Small suppliers are not automatically out. Small and micro MSPs are exempt from that measure, but they can still be designated as critical suppliers if they meet the conditions.
- Data centres above a threshold, and relevant digital service providers, also come into scope under their own factsheets.
The reporting clock
The Bill replaces today’s NIS reporting with a two-step clock. A light-touch initial notification within 24 hours, to the regulator and the NCSC at the same time, then a fuller report within 72 hours. Managed service providers, digital service providers and data centres must also identify which of their customers are likely to have been affected, and tell them.
That last duty is the one most organisations have not planned for. If your IT provider is in scope, you will hear from them when something goes wrong on their side. The question is whether anyone in your organisation would know what to do with that notice.
The penalties
The enforcement factsheet sets two bands: up to £17 million or 4% of worldwide turnover, whichever is higher, for the more serious breaches, including incident notification and security duties; and up to £10 million or 2% for less serious ones. How “turnover” is measured is left to secondary legislation.
What is worth doing now
- If you are an MSP: work out whether you are small or micro, and whether any of your customers are operators of essential services. Then test whether you could notify within 24 hours and name the affected customers.
- If you buy managed services: check your contract says who tells whom, how fast, and through which named contact, when an incident on the supplier’s side affects you.
- Either way: do not buy a “compliance programme” against regulations that have not been made. Buy clarity about your own incident clock.
The question your board should ask
“If our IT provider told us at 6pm on a Friday that one of its incidents may have affected us, who here receives that message, and what do they do in the first hour?”
Our free first-hour guide is a good place to start. We never assess work we have advised on, and we never sell the fix for anything we assess. If you want an independent view of your position, the first conversation is free.
Checked on 30 September 2026 against UK Parliament bill stages and the government’s factsheets (30 June 2026). The Bill may change at report stage and third reading; we will update this briefing when it does.