Cyber Security and Resilience Bill: The UK CISO's 24-Hour Test | INFORMD Executive Briefing

Cyber Security and Resilience Bill: The UK CISO’s 24-Hour Test

ByGovind Sharma

UK CISOs should prepare now for a 24-hour early incident notification under the Cyber Security and Resilience Bill, which updates the Network and Information Systems Regulations 2018 (NIS) and is expected to reach Royal Assent around the turn of 2027.

The Bill, currently progressing through the House of Lords, widens NIS to managed service providers, data centres and designated critical suppliers, and gives regulators and the Information Commission stronger enforcement tools. Detail will arrive in secondary legislation, but the direction is fixed. This briefing sets out what to do before the final text lands. It builds on our earlier work on the NCSC Cyber Assessment Framework and cyber resilience testing.

Does the Bill apply to your organisation?

The existing NIS regime covers operators of essential services in energy, transport, health, water and digital infrastructure, plus relevant digital service providers. According to PwC UK, the Bill extends oversight to data centre operators, large load controllers, managed service providers and designated critical suppliers, including international firms serving UK customers.

According to law firm Mayer Brown, non-enterprise data centres fall in scope at 1 megawatt of rated IT load and enterprise data centres at 10 megawatts. Managed service providers are caught where they provide ongoing management of customers’ IT systems in the UK. Regulators may also designate a supplier as critical where its failure could cause significant disruption to an essential service.

Even if you are not regulated directly, your customers may be. Expect flow-down obligations in contracts, questionnaires and audit rights, much as DORA has done for UK firms serving EU financial entities.

Executive Action

  • Map every service you deliver to a regulated operator, and record whether you could be designated a critical supplier.
  • Confirm with Legal whether any UK or EU entity falls under NIS, the Bill or DORA.
  • Report scope conclusions to the CEO and risk committee in writing.

What does the 24-hour reporting clock require?

According to PwC UK, major incidents must be notified within 24 hours for early notification, with a full report within 72 hours. Mayer Brown notes the Bill as introduced sends notifications to the competent authority, the Information Commission and the relevant computer security incident response team.

A 24-hour clock starts when you become aware, not when you finish investigating. That is tighter than the 72-hour UK GDPR window for personal data breaches. A ransomware event now triggers several parallel clocks: the ICO, your sector regulator, the NCSC and possibly the FCA or PRA. Our ransomware response checklist covers the technical sequence; the Bill raises the stakes on the decision rights.

Executive Action

  • Pre-authorise one named executive to make the notification call at hour four, not hour twenty.
  • Build a single incident template that satisfies NIS, UK GDPR and sector regulator fields.
  • Rehearse a 24-hour notification in your next tabletop and time it.

How large could the penalties be?

According to Mayer Brown, the Bill as introduced sets maximum penalties at the greater of £10 million or 2% of worldwide annual turnover for standard failings. For the most serious contraventions, the ceiling rises to the greater of £17 million or 4% of worldwide turnover; exactly which failures sit in which tier could still change during the Bill’s passage. Final figures may change during passage, so treat them as planning assumptions.

Turnover-based penalties move cyber from an IT budget line to a balance sheet exposure. The Cyber Governance Code of Practice already expects boards to own this risk, and directors will struggle to claim ignorance of a statutory regime. The DSIT Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses reported a cyber incident, so the likelihood side of the equation is not theoretical.

Executive Action

  • Quantify exposure at 2% and 4% of turnover with the CFO and include it in the risk register.
  • Check cyber insurance wording for regulatory fines and notification costs.
  • Brief the board using the 4% figure as a stress case.

How should you test supplier and managed service risk?

The Bill’s most consequential shift is supply chain visibility. If your organisation outsources security operations, hosting or IT management to a managed service provider, that provider may soon be regulated, and you will need evidence of what that means in practice. Review contracts for 24-hour incident notice, audit rights and sub-contractor disclosure. Our critical third parties checklist offers a starting point.

Measure your suppliers against the NCSC Cyber Assessment Framework, which regulators are likely to use as the benchmark. An incident response retainer with agreed service levels also helps you meet short notification windows.

Executive Action

  • Rank suppliers by the service impact of a 24-hour outage and request CAF self-assessments from the top ten.
  • Amend contracts so suppliers notify you within hours, not days.
  • Use our free assessment tools and templates to structure the review.

What should the CISO tell the board this quarter?

Keep the message short: the Bill is coming, the clock is 24 hours, the penalty ceiling is 4% of turnover, and the gap to close is governance rather than technology. Ask the board to approve a readiness review against CAF, a notification rehearsal and a supplier contract refresh before Royal Assent and commencement. Asking early makes the spend look prudent rather than reactive.

Executive Action

  • Table a one-page readiness paper at the next risk committee.
  • Request budget for a CAF gap assessment and a timed notification exercise.
  • Agree a quarterly report on supplier assurance and incident readiness.

Frequently asked questions

When will the Cyber Security and Resilience Bill become law?

The Bill is in the House of Lords, with Royal Assent expected around the turn of 2027. Many operational details, including reporting thresholds, will follow in secondary legislation, so organisations should prepare now rather than wait for final rules.

Who must report incidents within 24 hours?

Regulated entities, including operators of essential services, relevant managed service providers, data centre operators and designated critical suppliers, must give early notification within 24 hours of becoming aware of a major incident, followed by a full report within 72 hours.

What are the maximum penalties under the Bill?

As introduced, the highest tier is the greater of £17 million or 4% of worldwide annual turnover for the most serious contraventions. Standard failings carry up to £10 million or 2%. Figures may change during parliamentary passage.

Does the Bill replace the NCSC Cyber Assessment Framework?

No. The Bill updates the NIS Regulations 2018. The NCSC Cyber Assessment Framework remains the likely benchmark for demonstrating that security measures are appropriate and proportionate, so it is the best readiness yardstick today.

About INFORMD

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library (/resources/) or access our free assessment tools (/tools-assessments/). To discuss a briefing for your board, contact us.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk (/resources/).

Govind Sharma is the founder of Informd. He has more than 30 years of leadership experience helping sizable businesses use AI and technology to grow and transform, creating more value for their customers. His work has spanned every area of the business, from growth and cost efficiency to compliance and governance, up to board level. He holds an MBA and a PGDCA.

Similar Posts