The UK’s New Cyber Security and Resilience Bill

What is the Cyber Security and Resilience Bill? 

The UK Cyber Security and Resilience (CS&R) Bill is a major update to the country’s cyber laws. It is designed to strengthen the protection of essential services, including the NHS, energy networks, water companies, transport systems and key digital infrastructure such as data centres and cloud services. 

The Bill updates and expands the existing Network and Information Systems (NIS) Regulations 2018, which already set baseline cyber requirements for a handful of critical sectors. But those rules are now seen as too narrow and too slow for today’s threats. 

In July 2024, the government announced in the King’s Speech that it would bring forward the Bill. A detailed policy statement followed in April 2025, and the Bill was formally introduced to Parliament on 12 November 2025. In simple terms, the aim is to: 

• Bring more organisations into scope, especially those that sit behind the scenes but keep everything running.
• Make serious cyber incidents visible faster.
• Give regulators sharper tools to raise standards and act when organisations fall short.
• Allow the rules to be updated as threats and technology evolve.

Why now? The risks driving the reforms. 

Cyber-attacks are no longer rare or theoretical. They are a daily reality, and the consequences can be painfully real. 

• A ransomware attack on an NHS pathology supplier in London led to more than 11,000 postponed appointments and procedures and has been linked to at least one patient death.
• The National Audit Office has warned that many critical government IT systems have “substantial” cyber-resilience gaps, with recent incidents hitting the British Library, parts of the armed forces’ payment systems, and local authorities. [View related article on The Guardian]
• The National Cyber Security Centre (NCSC) reports that hostile cyber activity against the UK is becoming more frequent, more sophisticated, and more damaging. There are hundreds of significant incidents each year and ransomware still the most immediate threat to critical infrastructure.
• Government estimates suggest cyber-attacks now cost the UK economy £15 billion a year. 

At the same time, the way we deliver essential services has changed dramatically: 

• Hospitals, power grids, trains, and water companies rely on complex digital systems, often hosted in large data centres.
• Many organisations outsource key IT and cyber functions to managed service providers (MSPs).
• Modern technologies like electric vehicle charging, smart devices and AI-enabled systems create fresh opportunities, but also new cyber weaknesses. 

The government’s own assessment is blunt: the current cyber regulations “have fallen out of date and are insufficient to tackle the cyber threats faced by the UK.” 

The Bill is therefore framed not just as a security measure, but as a foundation for economic growth: you cannot have a digital, AI-driven economy if the underlying systems are fragile and easy to disrupt.

Who will feel the impact? 

The Bill’s direct impact falls on a defined set of organisations, but its ripple effects will be felt much more widely. 

Directly regulated organisations include: 

• Existing NIS operators (energy networks, transport operators, water utilities, major healthcare providers, and core digital infrastructure such as internet exchange points).
• Newly in-scope entities: data centres, MSPs, large electrical load controllers, and designated critical suppliers. 

These organisations will face clearer duties around risk management, incident reporting, governance, and supply-chain security, often assessed against the NCSC’s Cyber Assessment Framework. 

Indirectly affected organisations will include: 

• Suppliers to regulated entities, from software vendors to specialist service providers, who may see tougher security clauses in contracts and more questions from customers about their own cyber practices.
• Businesses relying on data centres or managed services, who should benefit from greater transparency about incidents and more assurance that their providers are properly regulated.
• Boards and senior leaders, who will be under growing pressure from regulators, investors, and insurers to prove that cyber resilience is being treated as a core business risk, not just an IT problem. 

And of course, citizens and customers, who may never hear the phrase “Cyber Security and Resilience Bill” but will notice its effects in the reliability of public services and the handling of major cyber incidents.

What should organisations do now?

The Bill is still going through Parliament and will come into force in phases after Royal Assent. But waiting passively would be a mistake. There are some clear steps an organisation can take now, especially if it operates in or supplies critical services.

1. Work out if you are likely to be in scope. 

• Are you an operator of essential services (energy, transport, health, water, digital infrastructure)?
• Do you operate large data centres, provide managed IT/cyber services, manage electrical load, or function as a key supplier to any of the above?

2. Benchmark against recognised guidance. 

• Use the NCSC Cyber Assessment Framework or Cyber Essentials as a starting point.
• Identify gaps in areas like governance, risk management, access control, vulnerability management, and incident response. 

3. Stress-test your incident response. 

• Could you realistically detect, triage, and report a serious incident within 24 hours?
• Do you know who would sign off the notification, and who would talk to customers, regulators, and the media? 

4. Map and strengthen your supply chain. 

• Understand which suppliers you rely on for critical services and how you would cope if one of them suffered a cyber-attack.
• Build clearer security expectations and incident-notification requirements into new contracts. 

5. Get the board engaged. 

• Treat cyber resilience as a core part of business strategy and risk management, not just a technical issue.
• Use the Bill to ask: “If we were in front of a regulator after a major incident, what story would we tell about how we managed this risk?” 

6. Use the free support that already exists. 

• NCSC guidance, the Cyber Governance Code of Practice, and government-backed schemes such as Cyber Essentials are all designed to help organisations raise their game without starting from nothing.

In summary 

The Bill is not about turning every organisation into a cyber specialist. It is about recognising that cyber-attacks are a fact and making sure that the services we all rely on can withstand them. For non-experts, you can think of it as a building-regulations update for the digital world: setting clearer rules for those who design, operate and maintain critical systems, so that the rest of us can safely flip a switch, tap a card, book an appointment or open an app and trust that it will work when we need it most.