How to comply with the Cyber Security and Resilience Bill
A step-by-step compliance guide covering registration, security duties, incident reporting, and supply chain obligations. Know exactly what your organisation needs to do and when.
Am I in scope?
The Cyber Security and Resilience Bill applies to significantly more organisations than the NIS Regulations 2018 it replaces. You are likely in scope if you fall into any of these categories:
Operators of Essential Services (OES)
Energy, transport, health, water, and digital infrastructure providers
Relevant Digital Service Providers (RDSPs)
Cloud computing, online marketplaces, and search engines
Relevant Managed Service Providers (RMSPs)
IT support, maintenance, monitoring, or managed security services
Critical suppliers
Any supplier whose failure could significantly disrupt essential services -- even small businesses
Data centres
Facilities with 1MW+ rated IT load capacity (or 10MW+ enterprise-only)
Large load controllers
Organisations managing 300MW+ of electrical control
Not sure where you fit? Take the free readiness assessment or read our who's affected guide.
Step-by-step compliance framework
Eight actions to move your organisation from awareness to full compliance with the Cyber Security and Resilience Bill.
Determine your classification
Identify whether your organisation falls under OES, RDSP, RMSP, critical supplier, or a combination. Your classification determines which regulator you report to, which duties apply, and the penalty regime you fall under.
Review the expanded definitions in the Bill. MSPs providing IT support/monitoring are now RMSPs. Data centres with 1MW+ capacity are essential services. Even small suppliers can be designated as critical.
Register with your regulator
All in-scope organisations must formally register with their designated sector regulator within the prescribed period and keep that registration current.
Provide company details, directors, contact information, and services you provide. Update within 7 days of any changes. If based outside the UK, nominate a UK representative. Your registration data is shared with GCHQ.
Implement security duties (NCSC CAF)
Align your security posture with the NCSC Cyber Assessment Framework, which moves from voluntary guidance to a legal baseline under the Bill.
The CAF covers four objectives: (A) Managing security risk, (B) Protecting against cyber attack, (C) Detecting cyber security events, (D) Minimising impact of incidents. 14 principles and 39 contributing outcomes provide the benchmark regulators will assess against.
Establish incident reporting processes
Build the capability to detect, assess, and report significant cyber incidents within the mandated timelines.
Submit an initial notification to both your regulator and the NCSC within 24 hours of becoming aware of a significant incident. Follow up with a detailed incident report within 72 hours covering impact, root cause, and remedial actions.
Near miss reporting capability
The Bill expands the definition of "incident" to include occurrences capable of having a significant impact, even if no actual disruption occurred.
This demands detection capabilities beyond basic monitoring. You need to identify and report blocked attacks, mitigated intrusion attempts, and vulnerabilities that could have caused significant disruption. You cannot report what you do not detect.
Supply chain security review
Assess the cyber resilience of your supply chain. Regulators can designate your suppliers as "critical suppliers" with direct regulatory obligations.
Perform supply chain risk assessments. Identify suppliers who rely on network and information systems and whose failure could disrupt your essential services. Review contracts to ensure suppliers can meet reporting timelines and security standards.
Customer notification processes
After reporting an incident to your regulator, you must notify affected customers as soon as reasonably practicable.
Prepare notification templates explaining the nature of the incident and why customers may be adversely affected. Build processes to quickly identify affected UK customers. Regulators may also require public disclosure of incidents.
Annual reporting preparation
Submit annual reports on incidents to the Single Point of Contact by 1 July each year, creating an ongoing compliance obligation.
Track all incidents and near misses throughout the year. Maintain audit trails of security measures, risk registers, and incident logs. Be prepared for on-site inspections and information requests from your regulator at any time.
Which regulator enforces your compliance?
The UK uses sector-specific regulators. Your classification determines who you report to and who can inspect, fine, and enforce.
| Sector | Regulator | Covers |
|---|---|---|
| Energy | Ofgem | Electricity and gas generation, transmission, and distribution |
| Transport | Department for Transport (DfT) | Aviation (via CAA), rail, road, and maritime operators |
| Health | Department of Health and Social Care (DHSC) | NHS trusts, hospitals, and health service providers |
| Drinking water | Drinking Water Inspectorate (DWI) | Water supply and distribution operators |
| Digital infrastructure | Ofcom | Telecommunications, DNS, IXPs, and digital infrastructure providers |
| Digital services (RDSPs) | Information Commissioner (ICO) | Cloud computing, online marketplaces, and search engines |
| Managed service providers | To be confirmed (secondary legislation) | IT support, monitoring, maintenance, and managed security services |
| Data centres | To be confirmed (secondary legislation) | Facilities with 1MW+ rated IT load capacity |
Regulators can designate critical suppliers
If your organisation supplies goods or services to an OES, RDSP, or RMSP and your failure could cause significant disruption, a regulator may designate you as a critical supplier with direct regulatory obligations -- regardless of your size. This includes suppliers based outside the UK.
Key compliance areas under the CSRB
Four pillars your organisation must address to achieve and maintain compliance.
Security duties (NCSC CAF alignment)
Implement security measures across the four CAF objectives: managing security risk, protecting against cyber attack, detecting security events, and minimising impact. Regulators will assess your compliance against the CAF's 14 principles.
Incident and near miss reporting
Report significant incidents and near misses within 24 hours (initial notification) and 72 hours (detailed report) to both your sector regulator and the NCSC. Includes the expanded definition covering events capable of causing significant impact.
Registration and annual reporting
Register with your sector regulator within the prescribed period. Update registration within 7 days of changes. Submit annual incident reports by 1 July. Maintain audit trails for on-demand inspection.
Supply chain security
Assess cyber resilience across your supply chain. Your critical suppliers may be directly regulated. Review contracts to ensure third parties can meet reporting timelines and security standards set by Codes of Practice.
Penalties for non-compliance
The Bill introduces a two-tier penalty regime with significantly increased maximums:
Higher band (serious breaches)
Up to the greater of £17M or 4% of worldwide turnover
Standard band
Up to the greater of £10M or 2% of worldwide turnover
Regulators also have powers to issue enforcement notices requiring immediate action, conduct on-site inspections, test systems, remove equipment, and recover the costs of supervision from regulated organisations. Failure to comply with an information notice is itself a penalisable offence.
NCSC Cyber Assessment Framework (CAF)
The CAF is expected to move from voluntary guidance to a legal compliance baseline. Regulators will assess your security posture against these four objectives.
Managing security risk
Establish governance, risk management processes, and asset management. Ensure your board understands cyber risk and that responsibilities are clearly defined.
Protecting against cyber attack
Implement proportionate security measures: access control, data security, system security, resilient networks, and staff awareness training.
Detecting cyber security events
Deploy security monitoring across your estate. The near miss reporting obligation demands detection capabilities that go beyond basic alerting.
Minimising impact of incidents
Maintain tested response and recovery plans. Demonstrate the ability to report within 24 hours, notify customers, and restore services.
The CAF comprises 14 principles and 39 contributing outcomes. Codes of Practice issued under the Bill will describe recommended measures for compliance, and courts and regulators must take them into account when determining compliance questions.
CSRB compliance FAQ
Answers to the most common questions about complying with the Cyber Security and Resilience Bill.
How do I comply with the Cyber Security and Resilience Bill?+
What are the CSRB compliance requirements?+
When do I need to register under the CSRB?+
Which regulator do I report to under the CSRB?+
What happens if I do not comply with the CSRB?+
Does the CSRB apply to managed service providers and data centres?+
Ready to start your compliance journey?
Our cyber security compliance specialists can assess your current posture, identify gaps against the Bill's requirements, and build a prioritised roadmap to full compliance.