- The Bill replaces the NIS Regulations 2018 with broader scope, covering managed service providers and data centres for the first time
- Mandatory incident reporting windows tighten significantly, with a new requirement to notify government as well as the sector regulator
- Regulators gain proactive inspection powers and no longer have to wait for an incident to investigate
- Supply chain security becomes a formal obligation, not just good practice
- The Secretary of State can update in-scope sectors by statutory instrument, without new primary legislation
Why the NIS Regulations needed replacing
The Network and Information Systems (NIS) Regulations 2018 were the UK's transposition of the EU's original NIS Directive. They covered operators of essential services in sectors like energy, transport, health, and water, plus certain digital service providers. The enforcement model was reactive: regulators could investigate after an incident, and the list of in-scope organisations was fixed.
The threat landscape has moved faster than the legislation. Ransomware attacks on the NHS, supply chain compromises reaching hundreds of downstream organisations through a single managed service provider, and attacks on data centre operators have all exposed gaps the 2018 regulations were not designed to address. The government concluded that the current framework is too narrow in scope, too slow to adapt, and gives regulators too little leverage before incidents happen.
The Cyber Security and Resilience Bill, announced in the King's Speech in July 2024, is a structural replacement, not an incremental update.
What the expanded scope covers
The most significant change is who falls under the legislation. The NIS Regulations applied to operators of essential services identified sector by sector, and to a narrow set of digital service providers. The Bill expands both categories.
Managed service providers
MSPs enter scope for the first time. The Kaseya attack in 2021, where a single compromise spread ransomware to roughly 1,500 downstream businesses in hours, made this extension foreseeable. Under the Bill, an MSP that manages IT for NHS trusts, local councils, or utilities is treated as critical infrastructure in its own right, not as a third-party supplier that happens to touch regulated entities.
If your business provides managed IT services, managed security services, cloud management, or network management to any organisation that operates in a regulated sector, you are likely in scope.
Data centres
Large data centres enter scope as a distinct category. The 2021 outages at major hyperscalers, and the reliance of financial services, health, and government systems on a small number of facilities, made this extension predictable. Operators of data centres above a threshold size will face the same incident reporting and security requirements as operators of essential services.
Supply chain obligations
Organisations already in scope under the 2018 regulations face new obligations around their supply chains. Securing your own systems is no longer sufficient. You must have documented processes for assessing and managing the cyber risk your suppliers introduce. This mirrors the approach taken in NIS2 for EU-based organisations and brings UK-regulated entities to a comparable standard.
Incident reporting changes
Under the NIS Regulations, in-scope organisations reported significant incidents to their sector regulator within timeframes that varied by regulator. The Bill standardises and tightens both.
The Bill introduces a two-stage reporting requirement. Organisations must send a preliminary notification to both the sector regulator and a central government body within 24 hours of becoming aware of a significant incident, then submit a full incident report within 72 hours. Any organisation whose incident response procedures lack an explicit regulatory notification step will miss both deadlines.
The central government notification step is new. Under the 2018 regulations, reporting went to the sector regulator only. The new model gives government a consolidated picture of the national cyber incident landscape, which ministers argue is necessary for coordinated response to large-scale or cross-sector events.
The definition of a "significant incident" is also broadened. Under the 2018 regulations, the threshold was impact on service continuity. The Bill adds incidents that carry the potential to affect continuity, even where an organisation contains them before disruption occurs. Early-stage compromises detected quickly must now be reported rather than handled internally.
Proactive enforcement powers
Compliance teams should pay closest attention here. The NIS Regulations gave regulators the power to investigate and impose penalties after an incident. The Bill gives them the power to inspect, audit, and require remediation before anything goes wrong.
Regulators will be able to issue information notices requiring organisations to demonstrate their security posture, conduct inspections of systems and processes, and issue improvement notices where they find gaps, all without waiting for an incident to provide the trigger. If you have relied on a "we haven't been breached so we must be fine" posture, that calculus no longer holds.
Penalties for non-compliance with improvement notices or reporting obligations can reach the higher of £17 million or 4% of global turnover. These sit close to the GDPR penalty framework and are likely to be applied with similar selectivity: large cases with clear negligence rather than routine minor failures.
The Secretary of State's power to extend scope
One of the Bill's less-discussed provisions carries long-term significance. The Secretary of State gains the power to designate new sectors or entity types as in-scope via statutory instrument, without new primary legislation. The current list of regulated sectors took years to update under the EU directive model. This provision lets the government respond to emerging risks, whether a newly critical sector, a category of technology infrastructure, or a type of service provider, within months rather than years.
Businesses adjacent to critical infrastructure face ongoing exposure. A sector outside scope today could move inside it within a single parliamentary session. Organisations with complex supply chain relationships to regulated entities should treat compliance preparation as a continuous programme rather than a one-time project.
The Bill's Legislative Journey
Successive governments have shaped this Bill over several years. The milestones below reflect publicly confirmed events and the current projected path to Royal Assent. Parliamentary schedules shift; the 2026 introduction date depends on the government's broader legislative programme. Track the timeline so your compliance team can set preparation dates, not respond to a law that has already passed.
For in-scope organisations, the window between Royal Assent and enforcement carries most weight. Previous UK frameworks gave organisations 12 to 18 months to comply before penalties applied. Use the milestones to plan against that window: consultation responses are shaping the final text now, and the distance between your current security posture and what the Bill requires means you should not wait until Royal Assent to begin.
National Cyber Strategy published. The government committed to reviewing the NIS Regulations as part of a broader critical infrastructure protection programme, identifying the 2018 framework as too narrow for the current threat environment and too slow to adapt to emerging risks.
Bill referenced as planned legislation. The Cyber Security and Resilience Bill was named in government communications as forthcoming primary legislation, setting expectations across regulated sectors ahead of the following year's King's Speech.
King's Speech confirmation. The incoming Labour government included the Cyber Security and Resilience Bill in the King's Speech on 17 July 2024, confirming legislative intent and signalling broad support for updating the UK's cyber regulatory framework.
DSIT policy statement. The Department for Science, Innovation and Technology published a policy statement outlining the Bill's intended scope: inclusion of MSPs and data centres, tighter incident reporting timelines, and new proactive inspection powers for sectoral regulators.
Consultation period. Industry bodies including techUK, BCS, and ISACA UK submitted responses during the public consultation, broadly supporting expanded scope while calling for proportionate implementation timelines and clear guidance on how MSPs will be classified.
First reading expected. The Bill is expected to be introduced to Parliament for its first reading, with committee stages to follow. Amendments during scrutiny will refine the definitions of in-scope entities and the precise incident reporting timelines.
Royal Assent and phased implementation. Subject to parliamentary progress, Royal Assent is projected for 2027 with a phased implementation window of 12 to 18 months before enforcement begins. Treat Royal Assent as the point at which compliance preparation must be complete, not the point at which it starts.
Three signals narrow the open questions: the Bill's formal introduction date, published statutory definitions for MSP and data centre eligibility thresholds, and the draft secondary legislation that fixes sector-specific reporting timelines. Each gives your legal and compliance teams fewer variables to plan around.
Cyber Resilience Bill vs NIS2: Key Differences
NIS2 entered force across EU member states in October 2024. If your organisation has European operations, subsidiaries, or serves EU customers, you now carry obligations under both frameworks. The table below maps the structural differences so your compliance team can see where the two regimes align and where they diverge.
| Dimension | UK Cyber Resilience Bill | EU NIS2 Directive |
|---|---|---|
| Jurisdiction | United Kingdom (post-Brexit) | EU member states |
| In force | Expected 2027 | October 2024 |
| Entity types covered | Essential services, MSPs, data centres | Essential and important entities |
| Incident reporting window | Expected 24 hours (early warning) / 72 hours (full report, to be confirmed) | 24 hours (early warning) / 72 hours (full report) |
| Minimum security measures | Baseline controls to be confirmed | 10 mandatory security measures |
| Supply chain requirements | Yes (explicit MSP scope) | Yes (proportionate measures) |
| Enforcement body | NCSC and sectoral regulators | National competent authorities |
| Fines | To be confirmed (expected percentage of global turnover) | Up to €10M or 2% of global turnover |
| UK-EU equivalence | Outcome-equivalent approach intended | N/A |
If your organisation is already working towards NIS2 compliance, your gap analysis, documented security measures, and incident response procedures provide a strong foundation for the UK Bill. Avoid running two separate compliance programmes. Map your controls against both frameworks in a single assessment, then address what each requires that the other does not.
The incident reporting timelines match. Supply chain obligations align in intent, though the UK Bill names MSPs as a distinct category where NIS2 leaves classification to member states. Governance requirements cover much of the same ground. The gaps sit in entity classification thresholds, the as-yet unconfirmed UK baseline security controls, and penalty structures. Work your team completes for NIS2 transfers to the UK Bill; the two frameworks share more than they diverge.
What to do now
The Bill is moving through Parliament and timelines will depend on the legislative programme. The direction is clear, and the gap between "compliant with NIS 2018" and "ready for the new framework" is large enough that preparation should start before Royal Assent.
- Determine whether you are newly in scope. If you provide managed services, operate a data centre, or sit in the supply chain of an existing regulated entity, assume you will be covered and plan accordingly.
- Review your incident response plan. Add explicit 24-hour and 72-hour regulatory notification steps. Identify who owns the notification decision and ensure they can act outside business hours.
- Document your supply chain security processes. Supplier risk assessments, contractual security requirements, and periodic reviews need to exist as documented processes, not informal practices.
- Close the gap between your current posture and what a proactive inspection would find. Regulators can now inspect before any incident occurs. Ask yourself what an auditor would find if they looked today.
- Watch the statutory instruments. Even if you are not in scope under the initial Act, monitor designations. New categories can be added quickly.
You can track official progress on the Bill at the UK Parliament Bills website. The NCSC publishes guidance on the existing NIS Regulations, which sets the baseline expectation for regulated organisations, at ncsc.gov.uk.