The Cyber Security and Resilience Bill: what UK SMEs and their IT suppliers should prepare for.

Cyber · 8 min · written 30 October 2026 · by the IT-360 team · sources at the end

What the Bill does

The Cyber Security and Resilience Bill updates the UK's 2018 Network and Information Systems regulations. It extends the regime to managed service providers, strengthens the powers of regulators and widens the definition of a reportable incident. It also lets the government bring further sectors and suppliers into scope by regulation rather than a new Act. It was introduced to Parliament in November 2025. Its exact start dates depend on secondary legislation, so check the current status before relying on a date.

Who is in scope

Directly: operators of essential services, digital service providers and data centres. For the first time, it also covers managed service providers that supply IT and security services to other organisations. Indirectly: every business that buys from them. A regulated supplier has to manage risk in its supply chain, and will pass obligations down through its contracts.

What changes for a small business

Expect your IT supplier's contract to be updated with incident-notification terms, security requirements for your side, and clearer statements of who does what. Expect to be asked for evidence of basic controls such as Cyber Essentials. If you supply a regulated organisation, expect the same questions from them.

What changes for an MSP

Registration with a regulator, and a set of security measures to meet and evidence. Plus a duty to report significant incidents within set timescales, including incidents at a client caused through your service. An ISO 27001 management system and Cyber Essentials Plus already cover much of the ground. The gap for most providers is the incident-reporting process and the records that prove it works.

What to do now

If you buy IT services, write to your provider and ask three questions. Are you in scope? What will change in our agreement? And when? If you are a provider, map your services against the Bill's categories, write the incident process, and run it once as an exercise. We have done ours; the Managed Security page explains how it reaches our clients.

Sources

• UK Parliament: Cyber Security and Resilience Bill, bill pages and explanatory notes.
• Department for Science, Innovation and Technology: policy statement on the Bill.
• NCSC: guidance for managed service providers.