UK Cyber Security and Resilience Bill

 

Fortifying Britain's Digital Defences

The United Kingdom is taking decisive action to protect its critical infrastructure and essential services from an escalating wave of cyber threats. Introduced to Parliament on 12 November 2025, the Cyber Security and Resilience (Network and Information Systems) Bill represents one of the most significant overhauls of UK cybersecurity legislation in years, responding to what the National Cyber Security Centre describes as a "diffuse and dangerous" threat landscape.

The Growing Cyber Threat

The urgency behind this legislation is unmistakable. Recent cyberattacks have demonstrated the devastating real-world consequences of digital vulnerabilities. In June 2024, a ransomware attack on Synnovis, an NHS supplier, disrupted over 11,000 medical appointments and procedures across major London hospitals, with estimated costs reaching £32.7 million. That same year, hackers breached the Ministry of Defence's payroll system through a managed service provider, exposing the vulnerability of even the most security-conscious government departments.

The scale of the challenge facing the UK is staggering. According to the 2024 Cyber Breaches Survey, half of all UK businesses reported experiencing some form of cybersecurity breach or attack in the past year. The NCSC recorded 1,957 cyber incidents across all sectors in 2024, with 430 classified as serious and 89 qualifying as nationally significant. Most alarmingly, nationally significant incidents surged by 130% in 2025 compared to the previous year.

The economic toll is equally severe. Cybercrime cost the UK economy an estimated £38.1 billion in 2024, with projections suggesting this could climb to £44.6 billion in 2025 and potentially reach £71.9 billion by 2027. Over the past five years, UK businesses have collectively lost approximately £253.1 billion in revenue to cyberattacks. The government estimates the current annual cost to the economy at £14.7 billion, roughly 0.5% of the UK's GDP.

Building on Existing Foundations

The new bill builds upon the Network and Information Systems Regulations 2018, which themselves originated from an EU directive. While post-implementation reviews found that the 2018 regulations played a vital role in raising UK resilience, they also concluded that progress had been too slow and updates were needed to keep pace with an evolving threat landscape.

The current regulations cover five sectors: transport, energy, drinking water, health, and digital infrastructure, along with some digital services including online marketplaces, search engines, and cloud computing. Twelve regulators, designated as "competent authorities," are responsible for enforcement. However, significant gaps have emerged, particularly around supply chain vulnerabilities and the narrow definition of reportable incidents.

The new legislation aims to align the UK more closely with the EU's NIS 2 Directive, which has applied across member states since October 2023, while maintaining a distinctly British approach that is more selective and adaptable to specific national needs.

Core Provisions and Expanded Scope

The bill significantly expands the scope of regulated entities and strengthens regulatory powers across multiple dimensions.

Managed Service Providers Enter the Frame

One of the most significant changes is the inclusion of managed service providers (MSPs) within the regulatory framework. For the first time, medium and large companies providing IT management, help desk support, and cybersecurity services to both private and public sector organizations will face mandatory security obligations. This addresses a critical vulnerability repeatedly exploited in recent attacks, where threat actors have gained access to multiple organizations through their shared service providers.

MSPs will be regulated not just by customer contracts but by statutory obligations, requiring them to enhance security measures, incident management protocols, and vendor governance. Because they hold trusted access across government networks, critical infrastructure, and business systems, their security posture has cascading effects across the entire digital ecosystem.

Data Centres Join Critical Infrastructure

Following their designation as Critical National Infrastructure in September 2024, data centres will fall under the new regulations. This recognition reflects their fundamental importance to modern life, from patient records and payment systems to email services and AI development. Research indicates approximately 224 colocation data centres operated by 68 companies currently exist in the UK, with around 182 third-party sites and 64 operators expected to fall within scope.

The bill also extends to organizations overseeing electricity delivery to smart appliances, including electric vehicle charging points and smart heating systems in homes, acknowledging the increasing digitalization of traditional utility services.

Healthcare Sector Reforms

The healthcare sector, including hospital trusts and diagnostic suppliers, will face particularly stringent regulation. The bill empowers regulators to designate critical suppliers, such as diagnostic laboratories, and require them to meet minimum cybersecurity standards. This addresses vulnerabilities exposed by attacks like the Synnovis incident, which demonstrated how disruption to a single supplier can cascade across multiple healthcare providers.

Healthcare organizations face unique compliance challenges given their reliance on legacy systems, tight budgets, and the imperative to prioritize patient care above other considerations. The bill acknowledges these constraints while establishing firm security baselines.

Water and Energy Infrastructure

The focus on water and energy sectors extends beyond core networks to encompass supply chains and digital systems such as Supervisory Control and Data Acquisition (SCADA) and remote monitoring systems. Given the potentially catastrophic consequences of successful attacks on nuclear power stations or water suppliers, contingency planning, resilience, and vendor governance become paramount priorities.

Enhanced Reporting and Transparency

The bill fundamentally restructures incident reporting requirements to provide earlier warning of emerging threats. Currently, incidents must result in actual service interruption to be reportable. This threshold has proven too high, allowing many concerning incidents to go unreported until damage has already occurred.

Under the new framework, organizations must report incidents that are capable of having significant impact on service provision, even if they haven't yet caused disruption. This captures pre-positioning attacks, where threat actors establish footholds in systems with the intention of causing harm later. Organizations will need to:

• Notify regulators within 24 hours of becoming aware of an incident
• Submit full reports within 72 hours
• Inform customers if they are likely to be impacted
• Report potential incidents that could cause significant disruption, not just those that have already inflicted damage

This expanded reporting regime aims to give regulators and the NCSC visibility into threats while they can still be mitigated, rather than only learning about attacks after significant damage has occurred.

Security Standards and the Cyber Assessment Framework

Organizations designated as operators of essential services will need to meet proportionate and up-to-date security requirements drawn from the NCSC's Cyber Assessment Framework (CAF). The bill places the CAF on firmer statutory footing, making it clearer what organizations must do to meet their security obligations and providing regulators with more robust enforcement tools.

The government will retain flexibility to update security requirements through regulations, allowing the framework to evolve as threats change without requiring new primary legislation. This adaptability recognizes that the cyber landscape moves exponentially, with significant developments possible in short timeframes.

Regular audits and reporting will be required to demonstrate adherence to these standards. While this will increase compliance burdens, particularly around administrative costs, the government argues that raising baseline security across critical sectors protects thousands of businesses in the long term by reducing systemic vulnerability.

Emergency Powers and Government Intervention

Perhaps the most striking new authority granted by the bill is the power for the Technology Secretary to issue emergency instructions during national security threats. These directives can be sent through regulators to in-scope organizations, including NHS trusts and major utilities like Thames Water.

Emergency instructions might require enhanced monitoring, system isolation, or other protective measures to safeguard essential services. This mirrors powers held by the US Cybersecurity and Infrastructure Security Agency, which can compel federal agencies to patch vulnerabilities on tight deadlines during active threats.

The inclusion of these emergency powers reflects the increasingly weaponized nature of cyber capabilities, with hostile states and state-sponsored actors regularly targeting UK infrastructure. The NCSC has warned that providers of essential services cannot afford to ignore these threats, with CEO Felicity Oswald noting the escalating danger from state actors.

Supply Chain Risk Management

The interconnected nature of modern business practices means organizations cannot secure themselves in isolation. The bill places explicit emphasis on supply chain cybersecurity, requiring entities to ensure their partners and suppliers also adhere to appropriate standards.

This addresses vulnerabilities repeatedly exploited in recent high-profile incidents. The Marks & Spencer breach in April 2024 exemplified supply chain risks when hackers compromised Tata Consultancy Services, the third-party supplier running M&S's IT helpdesk. By impersonating internal IT personnel, attackers tricked help desk staff into resetting passwords and providing network access, ultimately stealing sensitive customer information and causing an estimated £300 million in lost revenue.

Managing supply chains presents practical challenges, particularly beyond first-tier suppliers. The bill will need to balance comprehensive security with operational feasibility for organizations that rely on complex supplier networks.

Regulatory Structure and Enforcement

The existing structure of sector-specific regulators will be maintained and strengthened. The bill aims to ensure consistency across different regulators and coherence of approach across sectors, increasingly important as more entities enter the regulatory framework.

Cost recovery mechanisms may provide resources to regulators, with powers for proactive investigation of potential vulnerabilities rather than merely reactive enforcement after breaches occur. While specific penalties for non-compliance have not yet been detailed in the bill, the government has emphasized that enforcement will be meaningful.

The National Cyber Security Centre maintains a central coordinating role, receiving incident reports and providing actionable advice to defenders based on intelligence gathered across all sectors. This centralized visibility should enable more effective threat detection and response coordination.

Relationship to Other Initiatives

The Cyber Security and Resilience Bill forms part of a broader government cybersecurity strategy. Ministers recently wrote to all FTSE 350 CEOs urging them to strengthen defences, stressing that organizations recover better from incidents when they have planned for the worst and rehearsed their business continuity arrangements.

The government's work on ransomware, currently under consultation, will complement the bill, with coordination between the Department for Science, Innovation and Technology and the Home Office to ensure alignment and avoid duplication. In February 2025, plans emerged for potentially banning ransomware payments by public sector organizations.

The NCSC provides free guidance and tools including Cyber Essentials, Active Cyber Defence services, and the Cyber Assessment Framework to help organizations improve resilience. In April 2025, the government also published a Cyber Governance Code of Practice setting out clear steps organizations should take to manage digital risks.

Comparison to EU NIS 2

While the UK bill draws inspiration from the EU's NIS 2 Directive, it adopts a more selective approach. NIS 2 covers 18 critical sectors including food distributors, postal services, and waste management. The UK's framework is more focused, bringing in sectors where regulation will have maximum impact on improving overall cyber resilience.

NIS 2 expressly includes detailed security requirements that organizations must follow. The UK approach grants more flexibility, enabling the government to update requirements through consultation and regulations rather than embedding them in primary legislation. This allows faster adaptation to emerging threats while maintaining democratic oversight.

Both regimes share the fundamental recognition that the original NIS frameworks, while valuable, had not driven change quickly enough. Both expand scope, strengthen reporting, and empower regulators, reflecting convergent thinking on the essential elements of effective cyber regulation.

Industry and Expert Reactions

The bill has generally received positive reception from cybersecurity professionals and industry leaders. Jon Ellison, NCSC Director of National Resilience, called it "a landmark moment tackling the growing threat to the UK's critical systems" and "a crucial step towards a more comprehensive regulatory regime, fit for our volatile world."

Former NCSC head Ciaran Martin welcomed the legislative proposal, describing the mandatory reporting requirements as significant and positive steps. Richard Horne, current NCSC CEO, noted that "the real-world impacts of cyberattacks have never been more evident than in recent months."

Representatives from regulated sectors have expressed cautious support while seeking clarity on implementation. The Civil Aviation Authority's Head of Cyber Security Oversight noted that aviation contributes billions to the UK economy and requires proportionate, workable standards. NHS officials have emphasized the opportunity to drive a step change in cyber maturity across healthcare.

Some concerns have been raised about potential compliance burdens, particularly for organizations operating with tight margins or legacy systems. Industry representatives have called for thorough regulatory impact assessments and meaningful consultation on secondary legislation to ensure requirements remain practical and proportionate.

The CyberUp Campaign has expressed hope that the government will also update the Computer Misuse Act 1990, arguing that modernizing this legislation would help cyber professionals protect the UK and unlock growth within the cybersecurity industry.

Implementation Timeline and Next Steps

The bill received its first reading in Parliament on 12 November 2025 and now faces the standard legislative journey through both Houses. This includes second reading, committee stage, report stage, and third reading in the Commons, followed by similar stages in the Lords before receiving Royal Assent.

The government published a policy statement in April 2025 detailing confirmed and proposed measures, and released a full impact assessment that received a green rating (fit for purpose) from the Regulatory Policy Committee. Supporting documents include factsheets explaining specific measures and research informing the bill's content.

Given the urgency of the threat landscape and broad political support for strengthening cyber defences, the bill is expected to progress relatively quickly through Parliament, though the exact timeline for implementation remains to be confirmed.

Economic Implications and Growth Opportunities

While compliance will impose costs on regulated entities, the government argues the bill supports economic growth by reducing the enormous losses currently suffered from cyberattacks. The UK's cybersecurity sector itself contributed £13.2 billion to the economy in the latest financial year, and stronger regulations may drive further investment in defensive technologies and services.

The bill could unlock growth in the UK's cyber insurance market, which currently lags international peers. Only 45% of UK businesses carry any cyber insurance, with just 7% having standalone cyber policies. Clearer regulatory requirements may drive uptake by making risks more quantifiable and coverage more standardized, helping businesses transfer risk more effectively.

By establishing the UK as a leader in cyber resilience, the legislation may also attract businesses that prioritize security, particularly in sensitive sectors like financial services and advanced technology development.

Challenges and Considerations

Several challenges will emerge during implementation. Organizations will need time and resources to meet new requirements, particularly around reporting infrastructure, security audits, and supply chain governance. Small and medium enterprises in supply chains may struggle with compliance costs without appropriate support.

Balancing security with innovation and operational efficiency will require careful calibration. Overly prescriptive requirements could stifle technological advancement, while insufficient standards would leave critical gaps. The government's commitment to ongoing consultation aims to find this balance.

International alignment presents both opportunities and complications. While convergence with EU standards facilitates cross-border business, the UK must maintain flexibility to address its specific threat profile and national security requirements.

The bill's success ultimately depends on cultural change as much as regulatory compliance. Technology Secretary Liz Kendall has emphasized that cyber security is a shared responsibility and a foundation for prosperity, urging all organizations to follow NCSC guidance with the urgency that the risk requires.

Looking Ahead

The Cyber Security and Resilience Bill marks a watershed moment in UK cybersecurity policy. It acknowledges that digital infrastructure has become as essential as traditional utilities, deserving comparable regulatory oversight. It recognizes that security cannot be left entirely to market forces when critical services and national security are at stake.

As hostile state actors and organized criminal groups grow more sophisticated, and as emerging technologies like artificial intelligence create new attack surfaces, the need for robust cyber defences will only intensify. The bill provides a framework capable of adapting to this evolving landscape through regulatory flexibility and government emergency powers.

For organizations within scope, the message is clear: cybersecurity can no longer be treated as a purely technical concern to be managed by IT departments alone. It requires board-level attention, adequate resourcing, and integration into fundamental business operations. Those who embrace this reality early will be better positioned not just to comply with regulations, but to thrive in an increasingly hostile digital environment.

The true test of the bill's effectiveness will come not in its passage through Parliament, but in its implementation across thousands of organizations and its ability to genuinely reduce the frequency and impact of cyber incidents affecting British citizens and businesses. If successful, it could provide a model for other democracies seeking to balance security, innovation, and economic vitality in the digital age.