UK Cyber Security and Resilience Bill: What CISOs Must Build Now

UK CISOs must now build incident reporting infrastructure, expand scope assessments, and establish supplier notification processes ahead of Royal Assent of the Cyber Security and Resilience Bill.

The Cyber Security and Resilience Bill was introduced to Parliament in November 2025 and reached report stage in the House of Commons on 10 June 2026. Royal Assent is expected later this year. The Bill fundamentally expands the scope of the UK’s Network and Information Systems (NIS) Regulations — broadening mandatory coverage to managed service providers and data centres, tightening incident reporting timelines, introducing mandatory customer notification requirements, and increasing civil penalties to levels that will focus board attention. For UK CISOs, the window to prepare is now. The compliance obligations under this legislation are operationally demanding, and the organisations that start building capability before Royal Assent will avoid the scramble that followed GDPR and DORA.

Which Organisations Does the Cyber Security and Resilience Bill Now Cover?

The Bill’s most significant structural change is the extension of NIS-equivalent obligations to managed service providers (MSPs) and data centres — two categories that were outside the original NIS framework. For data centres, the Bill applies to facilities above specific power thresholds: 1 megawatt (MW) for small data centres and 10 MW for larger facilities. This means that a substantial number of colocation providers, hyperscale operators, and enterprise-owned facilities will fall within scope for the first time.

For MSPs, the scope extension is particularly consequential because it creates a direct regulatory relationship between the UK government and the technology service providers that underpin critical infrastructure. Previously, NIS obligations fell on operators of essential services and digital service providers — MSPs were indirectly exposed through their clients’ obligations but did not face direct regulatory duties. Under the Bill, MSPs providing services to UK-based organisations will need to assess whether they meet the coverage thresholds and, if so, register with the relevant competent authority and implement the full NIS compliance framework. CISOs in both MSP and data centre organisations should treat scope confirmation as their immediate first action.

Executive Action

• Conduct a formal scope assessment against the Bill’s criteria: confirm whether your organisation — or any subsidiary — meets the MSP or data centre thresholds, and document the assessment with legal sign-off before Royal Assent.
• Map your supply chain: if you are a buyer of MSP services, identify which of your critical MSPs will come into scope under the Bill — their new compliance obligations will affect your own incident notification timelines and contractual risk frameworks.
• Engage your competent authority early: organisations newly in scope for NIS-equivalent obligations should establish their regulatory relationship before the commencement date rather than waiting for formal notification requirements to trigger contact.

What Are the New Incident Reporting Requirements Under the Bill?

The Cyber Security and Resilience Bill introduces a two-stage incident reporting obligation that is materially more demanding than the current NIS framework. Organisations in scope must provide an initial notification to their competent authority within 24 hours of becoming aware of a significant incident — a threshold that compresses the current 72-hour NIS reporting window by two-thirds. A full incident report must then follow within 72 hours, providing comprehensive detail on the nature, scope, and impact of the incident.

Alongside regulator notification, the Bill introduces a requirement to notify affected UK customers when a significant incident impacts services they receive. This customer notification obligation is new to the UK NIS framework — it aligns the Cyber Security and Resilience Bill more closely with GDPR’s data subject notification approach and reflects the government’s view that downstream impact must be communicated promptly to allow affected organisations to take protective action. CISOs who have not already built a tiered incident notification process — distinguishing between regulatory, customer, and public disclosure tracks — must do so before the Bill commences.

Executive Action

• Rebuild your incident response playbook around 24-hour initial notification: most existing IR plans were designed for 72-hour NIS or GDPR timelines — war-game a significant incident against the 24-hour clock to identify process bottlenecks and decision rights gaps.
• Design and test a customer notification workflow: identify who holds the customer relationship, who approves notification content, and what the minimum viable notification looks like — this process must be executable within hours of an incident declaration, not days.
• Ensure your Security Operations Centre (SOC) — whether internal or outsourced — understands the 24-hour regulatory clock starts from when the organisation “becomes aware,” not when the incident is formally declared — this distinction has material legal significance under the Bill.

What Penalties Does the Bill Introduce and What Do They Mean for Boards?

The Cyber Security and Resilience Bill increases maximum civil penalties for non-compliance to £17 million or 4% of global annual turnover — whichever is higher. This penalty structure directly mirrors the GDPR enforcement framework and signals that the UK government intends NIS compliance to carry financial consequences equivalent to data protection obligations. For large organisations operating at global scale, 4% of global turnover represents a materially higher penalty than the £17 million cap — boards of UK-headquartered multinationals must factor this into their risk appetite assessments.

The penalty uplift creates a new board-level conversation about NIS compliance investment. Organisations that previously treated NIS as a technical compliance exercise — delegated to the CISO with minimal board visibility — must now reclassify it as a material financial risk. The precedent set by GDPR enforcement is instructive: regulators did not initially issue maximum fines, but the trajectory of enforcement has moved consistently towards larger penalties for systemic failures. CISOs who want board support for Cyber Security and Resilience Bill compliance programmes should frame the investment case around the enforcement risk, not just the technical requirement.

INFORMD’s executive briefings library includes detailed analysis of NIS compliance frameworks, DORA implementation, and UK cyber regulatory developments. The executive self-assessment tools and cybersecurity governance templates provide structured frameworks for CISOs preparing board-level cyber resilience presentations.

Executive Action

• Present the penalty framework to the board as a financial risk item — quantify the maximum penalty exposure for your organisation and benchmark it against current NIS compliance investment to create a defensible risk-investment ratio.
• Commission a NIS compliance gap assessment against the Bill’s expanded requirements before Royal Assent — document the findings formally so that board-approved remediation investment can be tracked against an independent baseline.
• Ensure your D&O insurance and cyber liability coverage has been reviewed against the new penalty regime — some policies have exclusions or sub-limits that may not adequately reflect the Bill’s maximum penalty exposure.

How Should CISOs Build Their Resilience Programme Before Royal Assent?

The Cyber Security and Resilience Bill provides CISOs with a defined implementation window — from the Bill’s current report stage through to Royal Assent and subsequent commencement. This window should be treated as a structured compliance sprint, not a watching brief. The organisations best positioned for NIS compliance have three capabilities in place before legislation commences: a complete and documented asset and service inventory across in-scope systems; a tested incident response and notification capability that meets the 24-hour initial reporting standard; and a supplier risk management framework that extends NIS-equivalent expectations to critical third parties.

The Bill’s expansion to MSPs creates a particular challenge for organisations that rely heavily on managed services for critical operations. If your MSP is now directly in scope, their incident notification to you becomes a regulatory event — you need to know how their notification timelines interact with your own reporting obligations. If your MSP is not in scope but provides services critical to your regulated operations, their security posture is now more directly your compliance risk than before. Either way, third-party risk management is no longer a best-practice aspiration — it is a compliance requirement with financial penalty consequences.

Executive Action

• Build a Bill implementation roadmap with milestones before Royal Assent: complete scope assessment (now), gap analysis (within 4 weeks), remediation plan with board sign-off (within 8 weeks), and tested incident response capability (before commencement date).
• Update critical supplier contracts to include Cyber Security and Resilience Bill notification requirements — MSPs providing services to your regulated operations should be contractually required to notify you within a timeframe that enables your own 24-hour regulatory reporting obligation.
• Run a full-scale incident response exercise specifically designed around the Bill’s requirements — include the 24-hour notification, customer communication, and 72-hour full report production as exercise objectives, and debrief formally against the results.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.