Key takeaways
Major cyber reforms ahead
Prepare before new obligations take effect.
Broader scope, wider impact
More organisations may fall within regulation.
Board-level cyber governance matters
Regulators will expect greater accountability and oversight.
October is Cybersecurity Awareness Month. As part of that we are taking this opportunity to provide an update on the Cyber Security and Resilience Bill. There has been some progress with the Bill since we last reported.
The Bill is intended to strengthen the cyber security of organisations in the UK that provide essential services, such as healthcare, drinking water and energy. It would amend the Network and Information Systems (NIS) Regulations 2018 (NIS Regulations) to include additional sectors and update incident reporting duties. It would also confer powers on the secretary of state to amend the legislation and issue directions to organisations when necessary for national security.
Key developments
The legislative Cyber Security and Resilience (Network and Information Systems) Bill is now well advanced and represents the most significant overhaul of the UK's cyber regulatory framework since NIS Regulations. The Bill has now progressed to the House of Lords but has yet to receive Royal Assent. The House of Lords Report stage gas been scheduled for 26 October 2026.
A wider range of organisations could be affected
It is expected to bring a significant number of previously unregulated businesses into scope such as Managed service providers (MSPs), data centres and other entities supporting critical services and digital infrastructure such as large load controllers (organisations that can remotely control or manage substantial amounts of electricity demand), health services, energy networks, water infrastructure and transport providers.
Greater focus on supply chain resilience
The Bill introduces powers to designate and regulate ‘critical suppliers’ where disruption could have systemic impacts on essential services. This reflects a growing focus on supply-chain cyber risk following major ransomware and software supply-chain attacks.
Regulators will receive enhanced oversight and enforcement powers, together with improved information-sharing mechanisms and greater government powers to respond to cyber threats affecting national security. In particular the Bill proposes to grant the Government broader powers to respond to cyber security threats, including through secondary legislation to expand the scope of the NIS Regulations, the ability to direct regulators and regulated entities to take specific action in the interests of national security, and the power to issue a statutory Code of Practice setting out recommended measures for compliance with the NIS Regulations.
More demanding incident reporting requirements
The proposed reporting regime is considerably more demanding than under the current NIS Regulations, with organisations expected to provide:
an initial incident notification within 24 hours
a more detailed report within 72 hours.
What should organisations be doing now?
While the final details are still emerging, organisations should begin assessing their readiness for the new framework. Key areas to consider include:
Map your exposure
Identify whether your business, services, or key suppliers are likely to fall within the anticipated scope of the Bill.
Review incident reporting process
Consider whether your existing incident reporting procedures are sufficient to meet the more demanding notification requirements (as above).
Assess cyber insurance coverage
Is your existing insurance cover for cyber risks sufficient?
Review governance arrangements
Ensure cyber resilience has appropriate oversight at senior management and board level.
Assess reporting readiness
Examine whether your incident response procedures can support faster notification requirements.
Engage with suppliers
Review contractual arrangements, audit rights, and information-sharing obligations, to understand your exposure to supply chain risks
Benchmark against frameworks
Align internal security policies with recognised standards such as ISO 27001 or the NCSC Cyber Assessment Framework which sets out cyber security risk management outcomes that organisations should seek to achieve.
Monitor legislative progress: staying informed will allow for early adaptation.
Although the strategic direction of travel is now relatively clear, important questions remain regarding the precise scope of the regime, the treatment of newly regulated organisations and the practical implementation of some of the new requirements. Much of this detail is expected to emerge through secondary legislation, regulatory guidance and, ultimately, enforcement activity.
We will continue to update as the Bill progresses.
For further information on the Bill, please contact our Commercial Disputes team.
