The Cyber Security and Resilience (Network and Information Systems) Bill would update the UK's Network and Information Systems (NIS) Regulations 2018 and, for the first time, regulate medium and large companies that provide IT management, helpdesk support and managed cyber security. If your business relies on an outside IT provider, or supplies an organisation that runs essential services, it is worth knowing what is coming.
This guide explains where the Bill has got to in Parliament, what it would change and what you can sensibly do now. It is accurate to 27 October 2026. The Bill is not yet law, many of its duties will need secondary legislation before they apply, and this is general information rather than legal advice.
What does the Bill mean for you?
Talk to Omega IT about how the proposed cyber rules could affect your IT and suppliers.
The short answer
The Bill has passed the House of Commons and has reached its last stage in the House of Lords. If it becomes law in its current form, it would:
- bring medium and large managed service providers (MSPs), the firms that run IT support, helpdesks and managed security for other organisations, into the NIS regime, regulated by the Information Commission, which took over from the Information Commissioner's Office (ICO) in September 2026;
- bring larger data centres into scope, regulated by Ofcom;
- require reportable incidents to be notified within 24 hours, with a full report within 72 hours;
- set two tiers of maximum penalty, the higher being the greater of £17 million or 4% of turnover.
For most small businesses the effect will be indirect, felt through the IT providers and suppliers they rely on. Nothing changes overnight, and there is no commencement date yet.
Where the Bill is now
The government introduced the Bill to Parliament on 12 November 2025, according to its published factsheets. Parliament's record of the Bill's stages shows how far it has come:
- House of Commons: first reading on 12 November 2025; second reading on 6 January 2026, with a carry-over motion so it could continue into the next session; committee stage in February 2026; reintroduced in the 2026–27 session on 14 May 2026; report stage and third reading on 16 June 2026.
- House of Lords: first reading on 17 June 2026; second reading on 14 July 2026; committee stage in September 2026; report stage on 26 October 2026.
- Next: Lords third reading is scheduled for 2 November 2026, although Parliament notes that future dates may be provisional.
At report stage, the Lords agreed amendments requiring a review of the effectiveness of the NIS scheme within twelve months and a register of state actors posing a threat to UK cyber security. An amendment on frontier AI was not agreed, Parliament reported. After Lords third reading, the Commons must consider the Lords amendments before the Bill can receive Royal Assent.
Royal Assent won't switch everything on at once. The government's summary of the Bill says certain measures would come into force on "Day 1" or "Month 2" after Royal Assent, while others will be brought in through secondary legislation. The duties on MSPs and the new incident-reporting rules fall into the second group, and the government says it intends to consult on implementation proposals in 2026.
Why the government is changing the rules
When it introduced the Bill, the government presented it as tougher protection against cyber attacks on essential services such as the NHS, transport and energy. Its announcement said the average cost of a significant cyber attack in the UK is now over £190,000, and put the total at around £14.7 billion a year.
Treat that £190,000 average with care. The government's own Cyber Security Breaches Survey 2025/2026 (CSBS) measures costs differently: it now reports only medians, because costs are highly skewed. Among businesses that identified a breach or attack, the median cost of the most disruptive one was £0, or £560 where the breach had an actual outcome. The survey stresses that a £0 median reflects many organisations reporting no direct financial loss, "not that harms are negligible".
The Bill also changes how quickly incidents reach the authorities. Under the current regime, an organisation only has to notify its regulator within 72 hours of becoming aware of a breach, and the regulator then tells the National Cyber Security Centre (NCSC). The Bill would get information to both at the same time, and extend the rules to some of the IT suppliers that sit behind other organisations. The logic is easy to follow: an IT provider often holds administrator access to many customers' systems, so a weakness at the provider can affect all of them.
Questions for your IT provider?
Get advice on supplier access, incident reporting and what to ask your managed service provider.
Who it brings into scope
The Bill extends the existing NIS framework rather than replacing it. According to the government's factsheets, the main additions are:
- Relevant managed service providers (RMSPs): medium and large MSPs, regulated by the Information Commission.
- Data centres: sites with a rated IT load (RITL) of 1 megawatt (MW) or more, or 10 MW for enterprise data centres run solely for their owner's own IT needs, regulated by Ofcom.
- Critical suppliers: some suppliers can be designated as critical suppliers, including small and micro MSPs that are otherwise exempt.
Managed service providers: the biggest change
For a business that buys IT support, this is the part that matters most, because it reaches the companies that look after other businesses' IT. The government's factsheet on relevant managed service providers defines an RMSP as a person who provides managed services in the UK, whether or not it is established in the UK, and is not a small or micro enterprise.
The definition of a managed service is broad. The factsheet's examples include IT outsourcing, such as remote support or helpdesks, management of applications such as email, and IT infrastructure management, plus managed security services such as a security operations centre (SOC) or security information and event management (SIEM). That covers much of what IT support companies do day to day.
Other points from the factsheet:
- The Information Commission would regulate RMSPs. It took over the ICO's functions on 30 September 2026 and is still known as the ICO.
- Small and micro MSPs are exempt from this measure, but can still be designated as critical suppliers.
- Once the regulations are commenced, an RMSP would have three months to register with the regulator.
If you are choosing or reviewing a provider, our guide on how to choose an IT support provider covers the wider questions. The Bill adds one more: is this provider likely to be regulated, and is it preparing?
Faster incident reporting
The government's incident reporting factsheet sets out a two-stage process:
- a "light touch" initial notification within 24 hours;
- a full report within 72 hours;
- the NCSC informed at the same time as the regulator, rather than afterwards.
The Bill would also require data centres, RMSPs and relevant digital service providers (RDSPs) to tell customers about cyber breaches that have likely affected them. For a business that relies on an IT provider, this may be the most practical change in the Bill: if your provider is in scope and suffers a breach likely to affect you, it would have to tell you.
That sits alongside, not instead of, any reporting duties you already have. If you are hit yourself, our ransomware attack response guide covers the first steps and who to contact in the UK.
Want help putting this in place?
Omega IT can set up the protections this guide covers.
Data centres and critical suppliers
Under the government's data centres factsheet, data centres with a rated IT load of 1 MW or more come into scope. Enterprise data centres, those operated solely for the IT needs of the person who owns them, are in scope only from 10 MW. Ofcom would be the operational regulator. Few small businesses run anything that size, but many rely on cloud and hosting services that sit in such facilities.
The critical supplier provisions could reach further. The Bill allows some suppliers to be designated as critical suppliers, and the RMSP factsheet confirms this includes small and micro MSPs that are exempt from the main RMSP rules. If your business supplies IT or other services to an organisation already regulated under NIS, watch for guidance as the secondary legislation develops, and keep evidence of your own security, such as Cyber Essentials certification, ready to share.
Penalties and regulators
The Bill text, as amended on Lords report, sets two maximum penalty levels for undertakings:
- Standard maximum: the greater of £10 million or 2% of turnover.
- Higher maximum: the greater of £17 million or 4% of turnover.
For contravening a requirement imposed by a national-security direction under Part 4, the Bill text gives a penalty figure of £100,000 per day. These are maximums for organisations within the regime, not typical fines.
The regulators would be the Information Commission for RMSPs and Ofcom for data centres, with the NCSC receiving incident reports at the same time as regulators.
What it means if you use an IT provider
Unless your business is itself an MSP, a data centre operator, already regulated under NIS or designated as a critical supplier, the Bill is unlikely to place new duties on you directly. Its value to you is the questions it gives you to ask your provider:
- Are you likely to be an RMSP? A medium or large provider should be following the Bill and planning for registration.
- How would you tell us about an incident? Ask who would contact you, how quickly and by what route, even if the provider is small and exempt.
- What can you access? Ask for a list of the accounts the provider's staff use on your systems. The Cyber Essentials requirements (v3.3) count accounts used by an MSP as in scope, so you need to know about them.
- Which certifications do you hold? Cyber Essentials or Cyber Essentials Plus is a sensible baseline; our comparison of Cyber Essentials vs Cyber Essentials Plus explains the difference.
- What does our contract say? Incident notification, cooperation during an investigation and exit arrangements should be in writing; our IT support contract checklist covers the clauses.
None of this depends on the Bill becoming law: these are reasonable questions to ask any provider today.
What to do now
- Get the basics certified. Only 5% of businesses hold Cyber Essentials, up from 3% in 2024/2025, according to the CSBS. Our Cyber Essentials self-assessment guide explains how to prepare.
- Write an incident response plan. The same survey found only 25% of businesses, and 21% of micro businesses, have a formal plan. Decide who does what in the first hours and who you would call; the ransomware guide above is a useful starting point.
- Know your suppliers. List every supplier with access to your systems or data and what each can reach, and remove access that is no longer needed. Our starters, movers and leavers checklist covers supplier accounts too.
- Test your recovery. Make sure backups exist, are kept separately and can actually be restored; see disaster recovery and business continuity for SMEs.
- Check your insurance. If you hold or are considering a cyber policy, our guide to cyber insurance for small businesses explains what insurers typically expect.
How Omega IT can help
Omega IT is a UK IT support company and is Cyber Essentials Plus certified. To talk through what the Bill could mean for your IT arrangements, from supplier access to incident response planning, speak to our team about cyber security or managed IT support, or request a free, no-obligation quote.
Sources
- UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill: stages (accessed 27 October 2026)
- UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill undergoes further scrutiny in the Lords (27 October 2026)
- UK Parliament: HL Bill 62, as amended on Report (October 2026)
- GOV.UK: Cyber Security and Resilience (Network and Information Systems) Bill: factsheets (last updated 30 June 2026)
- GOV.UK: Summary of the Bill (factsheet)
- GOV.UK: Relevant managed service providers (factsheet)
- GOV.UK: Incident reporting (factsheet)
- GOV.UK: Data centres (factsheet)
- GOV.UK: Tough new laws to strengthen the UK's defences against cyber attacks on NHS, transport and energy (12 November 2025)
- GOV.UK: Information Commission succeeds the ICO as UK's data protection regulator (30 September 2026)
- GOV.UK: Cyber security breaches survey 2025/2026 (30 April 2026)
- NCSC: Cyber Essentials: Requirements for IT infrastructure v3.3 (April 2026)
General guidance, accurate to October 2026. Diagrams by Omega IT.