Cyber Security and Resilience Bill compliance check
The UK Cyber Security and Resilience Bill (HL Bill 32) changes the rules. Verify your status, estimate your liability, and generate a compliance roadmap.
Takes approx. 3 minutes · Free & confidential
What is a cyber security readiness assessment?
A cyber security readiness assessment measures how prepared your organisation is to meet the obligations of the UK Cyber Security and Resilience Bill (CSRB). It evaluates your current security posture against the requirements that will apply once the Bill receives Royal Assent, expected between late 2026 and spring 2027, so you can close compliance gaps before enforcement begins.
The CSRB significantly expands the scope of the existing NIS Regulations 2018, bringing managed service providers, data centres, cloud platforms, and critical suppliers into the regulatory framework for the first time. Organisations that fall within scope must demonstrate adequate technical and organisational measures, report significant incidents within 24 hours, and maintain board-level accountability for cyber risk. Non-compliance carries penalties of up to the greater of £17 million or 4% of global turnover.
A board cyber readiness assessment gives senior leadership the evidence they need to understand their organisation's risk exposure, prioritise remediation investment, and demonstrate due diligence to regulators. It is an essential first step for any organisation that may be designated under the Bill.
What does this assessment cover?
Scope determination
Whether your organisation is likely designated as a regulated person, critical supplier, or managed service provider under Part 2 of the Bill.
Incident reporting readiness
Your ability to detect, assess, and report significant incidents within the mandatory 24-hour notification window (Section 15).
Supply chain risk management
How well you identify and manage cyber risks across your supply chain, including critical supplier dependencies (Section 12).
Board-level governance
Whether senior leadership has adequate oversight of cyber risk, as required for demonstrating due diligence under the enforcement regime.
Aligned with the NCSC Cyber Assessment Framework
This readiness assessment is informed by the NCSC Cyber Assessment Framework (CAF), the framework that regulators are expected to use when assessing compliance with the Cyber Security and Resilience Bill. The CAF provides a systematic methodology for evaluating cyber resilience across four objectives: managing security risk, protecting against cyber attack, detecting cyber security events, and minimising the impact of incidents. By benchmarking your organisation against these objectives now, you can build a defensible compliance position ahead of enforcement.
A clear picture of your readiness
Three minutes of questions, a tailored compliance roadmap at the end.
Scope analysis
Determine whether you are designated as Critical National Infrastructure (CNI) or a regulated provider.
Gap analysis
Assess your incident reporting and detection capabilities against the 24-hour mandatory window.
Action plan
Receive a personalised report with prioritised actions to avoid fines and potential personal liability.