The UK Cyber Security and Resilience Bill Explained
A practical guide to the UK Cyber Security and Resilience Bill - who it covers, the new incident-reporting duties and penalties, and how to prepare now.
If you run essential services in the UK, or supply the organisations that do, the rules you are measured against are about to change. The Cyber Security and Resilience Bill is the biggest update to the UK’s baseline cyber regulation since the NIS Regulations arrived in 2018, and it widens both who is covered and what “good” looks like.
This is a practical read - what the Bill does, who it affects, and the handful of things worth doing now while you still have runway.
What the Bill actually changes
The Bill builds on, rather than replaces, the existing NIS Regulations 2018. The Government’s stated aim is to bring UK regulation up to date with a threat landscape that has moved on considerably in the years since. Four themes stand out:
- More organisations in scope. The Bill extends coverage to additional sectors and, importantly, to more of their supply chains - managed service providers in particular. Attackers routinely reach their target through a smaller supplier, and the legislation reflects that.
- Stronger incident reporting. Broader and faster mandatory reporting is designed to give Government and regulators better visibility of what is actually happening across critical services.
- More regulator power. Regulators gain enhanced investigatory and enforcement powers, plus the ability to extend requirements as threats evolve.
- Higher penalties. The Bill introduces a tougher, tiered penalty regime for organisations that fall short.
If you have followed the EU’s NIS2 Directive, the direction of travel will feel familiar. The UK Bill is not a copy of NIS2, though, and the differences matter - so treat NIS2 readiness as a useful head start rather than a guarantee of UK compliance.
Who needs to pay attention
Two groups should be planning now.
The first is operators of essential services and important digital service providers - the organisations most people expect to be regulated. If you already sit under NIS, expect your obligations to deepen.
The second, and the one that catches people out, is the supply chain. If you provide IT, managed services, or security services to in-scope organisations, their new duties flow down to you through contracts and assurance requirements long before any regulator knocks. In practice, many mid-market firms will feel this Bill first as a wave of tougher security questionnaires and contractual clauses from their larger customers.
The timeline: less time than it looks
It is tempting to file this under “2028 problem” and move on. That would be a mistake.
The Bill was introduced in November 2025 and is progressing through Parliament during 2026, with Royal Assent expected later in the year. Much of the operational detail will arrive afterwards, in secondary legislation shaped by a Government consultation, and full enforcement is not anticipated until around 2028.
The catch is that the capabilities the Bill expects - reliable detection, tested incident response, credible supply-chain assurance - take months, not weeks, to build and evidence. The organisations that struggle in 2028 will be the ones that treated 2026-27 as downtime.
What the penalties could look like
Reporting on the Bill describes a two-tier structure, broadly:
| Category | Indicative maximum penalty |
|---|---|
| Standard contraventions | Up to £10 million or 2% of global turnover |
| Serious contraventions | Up to £17 million or 4% of global turnover |
| Ongoing contraventions | Daily penalties for continued non-compliance |
Whatever the final figures, the intent is clear: cyber resilience is moving from a best-effort expectation to an enforced one.
Five things worth doing now
You do not need the final text of the Bill to start. The groundwork is the same work that reduces your risk today.
- Confirm whether you are in or near scope. Map your services, and your key customers, against the likely criteria. If you supply in-scope organisations, assume their obligations will reach you.
- Get incident reporting ready. Broader mandatory reporting is coming. You need to be able to detect, triage, and report an incident quickly and consistently - which means tested detection and a plan people have actually rehearsed, not a document in a drawer. Our incident response service is built around exactly this, and our guide to building an incident response plan that works is a good starting point.
- Tackle supply-chain assurance from both sides. Understand the security posture of your critical suppliers, and be ready to evidence your own to customers.
- Cover the resilience basics. The current NCSC ransomware guidance now expects immutable, tested backups and phishing-resistant MFA everywhere remote access exists. These are exactly the controls regulators will look for.
- Close your detection gaps. You cannot report what you cannot see. Mapping detection coverage to real attacker techniques is the foundation everything else rests on.
The bottom line
The Cyber Security and Resilience Bill raises the UK’s cyber baseline and puts real enforcement behind it, and its reach extends well beyond the obvious critical-infrastructure names into their suppliers. The detail will keep shifting through 2026-27, but the capabilities it rewards - visibility, tested response, and supply-chain assurance - are worth building regardless of the final wording.
Not sure whether the Bill reaches you, or where your gaps are? Book a free 30-minute call and we will help you work out where to focus.
Frequently Asked Questions
What is the Cyber Security and Resilience Bill?
It is UK legislation that updates and expands the Network and Information Systems (NIS) Regulations 2018. It widens the range of organisations in scope, strengthens incident-reporting duties, and increases regulators' powers and penalties. The Government introduced it in November 2025 and it is progressing through Parliament during 2026.
Who does the Cyber Security and Resilience Bill apply to?
It targets operators of essential services and important digital service providers, and extends coverage to more of their supply chains - including managed service providers. If your organisation runs critical services, or supplies IT and security services to those that do, you should assume you may fall in or near scope and prepare accordingly.
When does the Cyber Security and Resilience Bill come into force?
At the time of writing (August 2026) the Bill is still moving through Parliament, with Royal Assent expected later in 2026. Much of the detail will follow in secondary legislation after a Government consultation, and the regime is not expected to be fully in force until around 2028. Treat 2026-27 as preparation time.
What penalties does the Bill propose?
Reporting on the Bill points to a two-tier penalty structure - broadly up to £10 million or 2% of global turnover for standard breaches and up to £17 million or 4% for serious ones, with daily penalties for continuing contraventions. Exact figures may change as the Bill progresses, so check the primary sources before relying on them.