UK Cyber Security and Resilience Bill Would Expand Regulation to MSPs and Data Centres
Summary
The proposed UK Cyber Security and Resilience Bill would expand NIS-style regulation to MSPs and data centres, introduce faster incident reporting, and strengthen supply-chain security duties.
Key points
- The Bill is expected to be introduced in Parliament during the 2025–26 legislative session; the 2018 Network and Information Systems Regulations remain in force for now.
- It would bring managed service providers and data centres into the regulatory regime, with powers to add further sectors through secondary legislation.
- The proposal includes an initial notification within 24 hours of awareness of a significant incident, followed by a full report within 72 hours.
- In-scope essential and digital service providers would become directly accountable for assessing and mitigating supply-chain cyber risks.
- The Bill would give the Cyber Assessment Framework a firmer statutory basis and support updated security requirements.
Article Details
- Event Type
- Proposed UK Cyber Security and Resilience Bill to expand and strengthen cybersecurity regulation.
- Impact
- The proposed Bill would bring managed service providers and data centres into scope, introduce faster incident reporting and statutory supply-chain security duties, and strengthen security requirements for regulated organisations. It is expected to be introduced in Parliament during the 2025–26 legislative session; until then, the 2018 Network and Information Systems Regulations remain in force.
People
Vendors
Products
Cyber Assessment Frameworkinstead relies on supporting and non-statutory guidance to close this gap, such as the NCSC’s Cyber Assessment Framework (CAF)[13].Cyber Security and Resilience BillThe UK government has made national security a key priority, and the new Cyber Security and Resilience Bill (CSRB) is a direct reflection of that focus. In introducing the Bill, Secretary of State for Science,Network and Information Systems RegulationsNIS2 Directivefalling behind international peers. The EU, which revised its cybersecurity regulation under the NIS2 Directive, already imposes stricter requirements on a broader set of sectors.
Countries
Industries
Digital infrastructuresectors—energy, transport, drinking water, health (Operators of Essential Services, OES) and digital infrastructure (Relevant Digital Service Providers, RDSPs).Drinking water(NIS) Regulations[8], the UK already supervises operators in five critical sectors—energy, transport, drinking water, health (Operators of Essential Services, OES) and digital infrastructure (Relevant Digital ServiceEnergyInformation Systems (NIS) Regulations[8], the UK already supervises operators in five critical sectors—energy, transport, drinking water, health (Operators of Essential Services, OES) and digital infrastructureHealthunderscored by recent high-impact incidents, including the Synnovis attack which targeted the National Health Service (NHS) suppliers and disrupted thousands of patient appointments and procedures[2]. The GovernmentTransportationSystems (NIS) Regulations[8], the UK already supervises operators in five critical sectors—energy, transport, drinking water, health (Operators of Essential Services, OES) and digital infrastructure (Relevant