October 2026 Update – The latest on the Cyber Security and Resilience Bill
Since this article was first published in April 2026, the UK Cyber Security and Resilience Bill has made significant progress through Parliament.
The Bill completed its passage through the House of Commons in June 2026 and has since progressed through the House of Lords, completing its committee stage in September. The next stage, known as Report Stage, is scheduled for 26 October 2026, when further amendments will be considered.
Although the Bill has not yet become law, there is now greater clarity around some of the proposed changes, particularly stricter cyber incident reporting requirements and increased oversight of managed service providers and critical suppliers.
For organisations, the message remains clear: cybersecurity is becoming an increasingly important part of business resilience, and understanding the risks associated with technology, third-party suppliers and incident response should be a priority.
While not every organisation will fall directly within the scope of the legislation, many could be affected indirectly through their suppliers, customers and wider supply chains. Taking steps to strengthen cyber resilience now will help businesses prepare for changing expectations as the legislation progresses.
Cybersecurity regulation in the UK is evolving. As cyber threats continue to grow in scale and sophistication, the government is strengthening legislation designed to protect critical services and the digital supply chains that support them.
One of the most significant developments is the proposed UK Cyber Security and Resilience Bill (CSRB). Although the legislation is still progressing through Parliament, several key themes are already emerging. For many businesses, especially those that rely heavily on technology and third-party IT providers, this bill is worth paying attention to now, especially at leadership and board level.
The direction of travel is clear. Organisations will increasingly be expected to demonstrate that they are actively managing cyber risk.
Why the UK is introducing the Cyber Security and Resilience Bill
The UK already has legislation that governs cybersecurity for essential services, known as the Network and Information Systems (NIS) Regulations 2018. These rules apply to organisations that operate critical infrastructure such as energy, transport, healthcare, and water.
However, the digital landscape has changed dramatically since 2018.
Cyber attacks are becoming more frequent, supply chains are more complex, and many organisations rely on external providers such as cloud services, software platforms, and managed service providers to run essential systems. Recent incidents such as large-scale supply chain attacks have demonstrated how vulnerabilities in one organisation can affect many others.
The bill aims to modernise the UK’s approach to cyber resilience by:
- expanding the scope of regulation
- improving incident reporting requirements
- strengthening the powers of regulators
- addressing risks within digital supply chains
Ultimately, the goal is to make sure organisations that underpin the UK economy and public services are better prepared for cyber incidents.
What is likely to change
Although the legislation is still moving through Parliament, several key themes are already clear.
1. More organisations may fall within scope
One of the biggest changes is the potential expansion of regulated organisations.
The existing NIS regulations focus primarily on operators of essential services. The new bill is expected to include a broader range of digital service providers and technology partners, recognising the critical role they play in delivering services.
This reflects a growing understanding that cyber risk often enters through supply chains rather than through the primary organisation itself.
2. Faster cyber incident reporting
(Updated October 2026) The Bill proposes stricter reporting requirements for significant cyber incidents. Organisations within scope would need to provide an initial notification within 24 hours of becoming aware of a reportable incident, followed by a more detailed report within 72 hours.
Organisations may need to notify regulators within a defined timeframe when certain incidents occur.
For many organisations, this means improving their ability to:
- detect incidents quickly
- assess their impact
- escalate issues internally
- communicate with regulators
3. Greater regulatory oversight
The bill is also expected to strengthen the powers available to regulators.
This could include the ability to request more detailed information about an organisation’s cyber risk posture, as well as increased penalties for organisations that fail to meet their obligations.
The aim is not to punish organisations, but to ensure that cybersecurity is treated as a core operational responsibility, rather than an afterthought.
4. More focus on supply chain security
Recent cyber incidents have demonstrated how vulnerabilities in one organisation can affect many others across entire supply chains.
(Updated October 2026) The Bill proposes greater oversight of third-party technology providers, including bringing medium and large managed service providers (MSPs) within the scope of cybersecurity regulations and introducing new powers to designate critical suppliers.
For organisations, this highlights the importance of understanding the cybersecurity measures their IT partners have in place and ensuring suppliers can respond effectively to incidents that could disrupt business operations.
What this means for organisations today
Although the bill has not yet become law, the direction of travel is clear.
Organisations will increasingly be expected to demonstrate that they are:
- actively managing cyber risk
- monitoring their systems and infrastructure
- responding quickly to incidents
- working with trusted technology partners
- considering cybersecurity at a strategic level
For many organisations, this will require closer alignment between IT teams, leadership, and risk management functions.
The businesses that will adapt most successfully are those that see cybersecurity not simply as a technical issue, but as part of their overall resilience strategy.
Preparing for the future of cyber regulation
While the final details of the Cyber Security and Resilience Bill are still being developed, it is already encouraging organisations to take a more proactive approach to cybersecurity.
Rather than waiting for regulation to dictate action, forward-thinking organisations are strengthening their cyber posture today by reviewing their security controls, incident response processes, and supply chain relationships.
Cyber resilience is becoming an essential part of organisational resilience, and the new legislation reflects that shift.
How ramsac helps organisations build cyber resilience
Navigating the evolving cybersecurity landscape can be complex, particularly as new regulations emerge alongside rapidly changing threats.
At ramsac, we help organisations understand their cyber risk, strengthen their security posture, and build resilient technology environments that support their long-term success.
By combining strategic advice with practical security solutions, we help organisations stay ahead of both evolving cyber threats and regulatory change.
How can we help you?
We’d love to talk to you about your specific IT needs, and we’d be happy to offer a no obligation assessment of your current IT set up. Whether you are at a point of organisational change, unsure about security, or just want to sanity check your current IT arrangements, we’re here to help.
UK Cyber Security and Resilience Bill: FAQs
The UK Cyber Security and Resilience Bill is proposed legislation designed to strengthen cybersecurity protections across critical sectors and digital service providers. It aims to update the existing Network and Information Systems (NIS) Regulations to address modern cyber threats and supply chain risks.
The bill is currently progressing through the UK Parliament. While timelines can change, it is widely expected that the legislation could be passed in 2026, with implementation and regulatory guidance likely to follow afterwards.
The bill is expected to apply to organisations that provide essential services or digital infrastructure that the UK economy relies on. This may include sectors such as energy, healthcare, transport, digital services, and organisations involved in critical technology supply chains.
Cyber threats have evolved significantly in recent years. The new legislation aims to strengthen the UK’s ability to prevent, detect, and respond to cyber incidents by improving security standards, incident reporting, and supply chain oversight.
Organisations can begin preparing by reviewing their cybersecurity controls, strengthening incident detection and response capabilities, and ensuring they have clear processes for managing cyber risks across their supply chains.
