Cyber Security and Resilience Bill guides.
Practical answers on the Cyber Security and Resilience Bill (CSRB): whether it applies to you, what you have to do, and how it fits with other laws.
Does it apply to you?
Cyber Security and Resilience Bill summary
The Cyber Security and Resilience Bill on one page: what it does, who it adds, what changes, when it starts and what is still moving.
Critical supplier designation notices: what to expect
What a critical supplier designation notice must contain under the Bill, how to respond, and your appeal rights. No official letter format exists yet.
A customer asked about the Cyber Security and Resilience Bill: a supplier’s guide
What to do when a customer asks what the Bill means for you as a supplier: check your status, reply accurately, and offer evidence without overcommitting.
The Cyber Security and Resilience Act: does it exist yet?
There is no Cyber Security and Resilience Act yet. See what the Bill would be called, what must happen first, and what changes on Royal Assent.
Does the Cyber Security and Resilience Bill apply to US and overseas companies?
Yes, where they meet the tests. The Bill reaches overseas providers serving the UK. See who is caught, UK representative rules and the regulators involved.
Does the Cyber Security and Resilience Bill apply to small businesses?
Micro and small firms are excluded from the digital and managed service duties, but not from every route. See the test and how duties reach you.
OES vs RDSP vs RMSP: which one are you?
What OES, RDSP and RMSP mean under the Cyber Security and Resilience Bill, who regulates each, and how to work out which applies to you.
Schedule 2 thresholds by sector: who counts as an operator of essential services
Every numeric threshold in Schedule 2 of the NIS Regulations 2018 by sector, plus the data centre and load control thresholds the Bill would add.
Which regulator covers you under the Cyber Security and Resilience Bill?
A sector-by-sector list of regulators under the Cyber Security and Resilience Bill, covering cloud, MSPs, data centres, energy, health and water.
What you have to do
24-hour incident notification: runbook and template
What the 24-hour notice must contain under the Cyber Security and Resilience Bill, with a timed runbook and unofficial 24-hour and 72-hour templates.
Breach vs incident vs near miss: what to report and to whom
The difference between a data breach, cyber incident and near miss, with one table showing what to report, who to tell and the deadlines.
What will the Cyber Security and Resilience Bill cost you?
Official cost estimates per organisation for MSPs, data centres and critical suppliers, what they leave out, and how to build your own budget.
The first 90 days after the Cyber Security and Resilience Bill duties start
An action plan for the first three months after the Bill’s registration and reporting duties start, counted from commencement rather than a guessed date.
How to register with your regulator under the Cyber Security and Resilience Bill
Who must register or notify under the Bill, what to provide, the three-month deadline, 7-day updates and penalties. No process has been published yet.
The Cyber Security and Resilience Bill impact assessment explained
What the Government estimates the Bill will cost, who it expects to catch, why the headline value is negative, and how far to trust the figures.
Incident reports under the Cyber Security and Resilience Bill and UK GDPR
One incident can trigger two reports. How the Cyber Security and Resilience Bill and UK GDPR differ on triggers, deadlines, recipients and records.
MSP compliance checklist for the Cyber Security and Resilience Bill
A step-by-step checklist for managed service providers: scope, registration, security duties, incident reporting, customer notices and evidence.
Regulator inspections: what happens and how to prepare
What regulators can do under the Cyber Security and Resilience Bill: information notices, inspections, enforcement, fines, appeals and how to prepare.
Appointing a UK representative under the Cyber Security and Resilience Bill
Who must nominate a UK representative under the Bill, what to tell the regulator, deadlines, what the representative does and what they do not take on.
What is a CSIRT? The UK model explained
What CSIRT means, who the UK CSIRT is, how it differs from a regulator or SOC, and what the Cyber Security and Resilience Bill requires you to send it.
What counts as a significant incident under the Cyber Security and Resilience Bill?
The reporting test for significant incidents, the factors regulators look at, how it differs for data centres, and worked examples.
When does the Cyber Security and Resilience Bill come into force?
The Bill starts in three stages: Royal Assent, two months later, then dates set by regulations. See what applies at each stage and what to do now.
Templates
72-hour incident report under the Cyber Security and Resilience Bill: guide and template
What the 72-hour full notification must contain, section by section, how to handle unknowns, and an unofficial template. Both clocks start at awareness.
Board paper template for the Cyber Security and Resilience Bill
An unofficial board paper template for the Cyber Security and Resilience Bill, covering scope, exposure, options, costs and the decisions you need.
Customer notification under the Cyber Security and Resilience Bill: guide and template
When data centres, RDSPs and RMSPs must tell customers about an incident, what the notice must say, penalties, and an unofficial template to adapt.
Near-miss log template for cyber security
An unofficial near-miss log template with example entries, what to record, how to run it and why it helps under the Cyber Security and Resilience Bill.
Cyber Security and Resilience Bill supplier questionnaire: sample answers
Common supplier questions about the Cyber Security and Resilience Bill, what a good answer includes, and answers to avoid. Unofficial examples to adapt.
How it fits with other laws
The Computer Misuse Act explained
The Computer Misuse Act 1990 in plain English: each offence, maximum sentences, what unauthorised means, and where reform stands.
CRA vs DORA vs NIS2: what is the difference?
The CRA covers products, NIS2 covers organisations in key sectors, and DORA covers financial firms. See how they differ and when they reach UK businesses.
Critical third parties and critical suppliers: what is the difference?
The UK’s financial critical third parties regime and the Bill’s critical suppliers are different. Who designates, who is covered and what to do.
The Cyber Security and Resilience Bill in Scotland, Wales and Northern Ireland
The Bill extends across the UK, but regulators and thresholds differ. See who regulates each sector in Scotland, Wales and Northern Ireland.
Does DORA apply to UK firms?
DORA is EU law and not part of UK law, but it can still reach UK groups and ICT suppliers. See who is caught and which UK rules apply instead.
Does NIS2 apply to UK companies?
NIS2 is an EU directive and does not apply in the UK, but UK companies operating in the EU or offering certain services there can still be caught.
FCA and PRA cyber requirements
The FCA and PRA rules on operational resilience, incident reporting and third parties, and how the Cyber Security and Resilience Bill fits alongside.
Global cyber incident reporting deadlines
UK, EU, US and Australian cyber incident reporting deadlines in one table, including what starts each clock and how to run a multi-country process.
The Government Cyber Action Plan and the Bill
How the £210m Government Cyber Action Plan relates to the Cyber Security and Resilience Bill, who it covers, and what public bodies and suppliers should do
Is penetration testing legal in the UK?
Penetration testing is legal in the UK with proper authorisation. How the Computer Misuse Act applies, what to get in writing and where reform stands.
Who is liable when an MSP's client is breached?
How regulatory, data protection and contract liability work when an MSP customer is breached, with scenarios and steps for both sides. Not legal advice.
NIS Regulations 2018 vs the Cyber Security and Resilience Bill
How the Cyber Security and Resilience Bill changes the NIS Regulations 2018: scope, incident reporting, fines, costs and what stays the same.
PSTI and the Cyber Security and Resilience Bill
PSTI covers connectable consumer products; the Bill covers services and systems. How they differ, where they overlap and what to check.
UK ransomware payment rules and the Bill
The UK’s proposed ransomware payment ban, prevention regime and reporting duty: who they cover, how they fit with the Bill, and what to do now.
The Cyber Security and Resilience Bill, section by section
Plain-English summary of all 61 sections and two schedules of the Bill as brought from the Commons, with who each part affects.
The Software Security Code of Practice explained
The UK’s voluntary Software Security Code of Practice: its 14 principles, who it is for, how to self-assess, and how it relates to the Bill.
The Telecommunications (Security) Act and the Bill
How the Telecommunications (Security) Act 2021 and the Cyber Security and Resilience Bill differ, and when a telecoms group can still be caught.
UK cyber security laws and regulations: the complete map
Every major UK cyber security law in one place: what it covers, who enforces it and how it relates to the Cyber Security and Resilience Bill.
UK law for managed service providers
The UK laws that apply to MSPs: the Cyber Security and Resilience Bill, UK GDPR, the Computer Misuse Act, contract law and customer rules.
Powers and politics
AI and the Cyber Security and Resilience Bill
How the Bill treats AI: the AISI review, AI-agent powers, whether AI companies are in scope, and what organisations using AI should do now.
Henry VIII powers in the Cyber Security and Resilience Bill
What Henry VIII powers are, which clauses contain them, why Lords committees raised concerns and what later rule changes mean for your compliance plan.
National security directions explained
How the Secretary of State could direct regulated organisations under Part 4: the test, what can be required, secrecy, penalties and how to prepare.
The register of foreign powers amendment explained
The Lords voted for a register of hostile states in the Cyber Security and Resilience Bill. What it would do, the arguments and what could happen next.
Cyber Security and Resilience Bill: secondary legislation tracker
What the Cyber Security and Resilience Bill leaves to regulations, codes and guidance, who decides each one, and the status of each as of 2 November 2026.
The statement of strategic priorities explained
What the Bill’s statement of strategic priorities is, how it differs from the 2025 policy statement, how it would be made, and why it matters to you.
Vendor-related direction powers explained
Proposed powers to make organisations stop using or remove a risky supplier. What is in the Bill, what is still only proposed, and how to prepare.
What Parliament has changed in the Cyber Security and Resilience Bill so far
A dated record of changes to the Cyber Security and Resilience Bill at Lords stages, what is confirmed, what is reported, and what could still change.
Boards and buying
Board cyber readiness assessment: 21 questions for directors
A self-check for directors on cyber readiness and the Cyber Security and Resilience Bill, with 21 scored questions and the evidence to ask for.
How to choose a security provider: questions to ask
A buyer’s checklist for choosing a managed security or testing provider ahead of the Cyber Security and Resilience Bill, with warning signs and scoring.
Cyber Essentials and the Cyber Security and Resilience Bill: is it enough?
Cyber Essentials is not required by the Bill and will not meet its duties alone. See how it compares, who should get it and how to make it count.
The Cyber Governance Code of Practice: a guide for boards
What the UK Cyber Governance Code of Practice asks of boards, how it relates to the Cyber Security and Resilience Bill and how to put it into practice.
Cyber insurance and the Cyber Security and Resilience Bill
What the Cyber Security and Resilience Bill means for cyber insurance: whether fines can be insured, notification clashes and questions for your broker.
Cyber Resilience Pledge signatories
Where to find the official Cyber Resilience Pledge signatory list, who has signed, what they commit to, and what being listed does and does not mean.
Are directors personally liable under the Cyber Security and Resilience Bill?
The Bill targets penalties at organisations, not directors. See what peers proposed, what duties directors already have and what to record now.
Managed security services contracts: what to review for the Bill
The clauses to review in a managed security services contract ahead of the Cyber Security and Resilience Bill, from incident alerts to audit and exit.
Pre-acquisition cyber due diligence: a practical checklist
What to check before buying a company: past compromise, regulatory status under the Bill, security, third parties, and how findings shape deal terms.
Cyber Assessment Framework
CAF 4.0 explained: what changed in the Cyber Assessment Framework
What changed in NCSC Cyber Assessment Framework 4.0, including threat, secure software and threat hunting outcomes, and how to update your assessment.
CAF Principle A1: Governance
What CAF principle A1 expects from boards, what evidence can show it and where organisations fall short, with links to the Bill’s security duties.
CAF Principle A2: Risk Management
CAF principle A2 covers risk process, understanding threat and assurance. See what changed in CAF 4.0, what evidence helps and how it links to the Bill.
CAF Principle A3: Asset Management
CAF principle A3 expects you to know every asset behind your essential functions, including people, data, power and cooling. See what evidence helps.
CAF Principle A4: Supply Chain
CAF principle A4 covers supplier risk and secure software development. See the two outcomes, suggested evidence and links to critical supplier rules.
CAF Principle B1: Service Protection Policies, Processes and Procedures
CAF principle B1 tests whether security policies are practical, followed and effective, not just written. See the two outcomes and evidence to gather.
CAF Principle B2: Identity and Access Control
CAF principle B2 covers authentication, devices, privileged users and access reviews. See how MFA and review expectations rise between rating levels.
CAF Principle B3: Data Security
CAF principle B3 covers understanding data, transit, storage, mobile data and sanitisation. See suggested evidence and how it links to the Bill.
CAF Principle B4: System Security
CAF principle B4 covers secure design, configuration, management and vulnerability handling, including automated decision-making in CAF 4.0.
CAF Principle B5: Resilient Networks and Systems
CAF principle B5 covers recovery preparation, resilient design and backups, including ransomware recovery. See suggested evidence and common gaps.
CAF Principle B6: Staff Awareness and Training
CAF principle B6 covers security culture and training. Learn why attendance figures are not enough and how quick staff reporting helps under the Bill.
CAF Principle C1: Security Monitoring
CAF principle C1 covers log sources, securing logs, alerts, triage, skills and threat intelligence. See suggested evidence and links to reporting rules.
CAF Principle C2: Threat Hunting
CAF principle C2 asks you to look for attacks your tools miss. See how the rating levels differ, suggested evidence and what a find means under the Bill.
CAF Principle D1: Response and Recovery Planning
CAF principle D1 covers the response plan, capability and exercising. See what to test, suggested evidence and how to add the Bill’s reporting duties.
CAF Principle D2: Lessons Learned
CAF principle D2 covers post-incident analysis and using incidents to improve, including near misses. See suggested evidence, gaps and links to the Bill.
CAF self-assessment: how to do it and what evidence to keep
How to run a Cyber Assessment Framework self-assessment: scoring, CAF profiles, what good evidence looks like and the mistakes to avoid.
CAF supply chain: how to meet principle A4
What CAF principle A4 expects on suppliers and secure software, what each rating means, contract terms to consider and the link to critical suppliers.
Linux security for the Cyber Assessment Framework and the Bill
The CAF and Cyber Security and Resilience Bill set no Linux rules. See how to map Linux hardening, patching and logging to CAF 4.0 outcomes.
Regulators
Drinking water regulators and the Cyber Security and Resilience Bill
Who regulates drinking water cyber security under NIS and the Bill in each UK nation: Defra, the DWI, Welsh Ministers, DWQR and Northern Ireland.
Ofgem, GEMA and the Cyber Security and Resilience Bill
Who regulates energy under NIS: the Energy Secretary, GEMA acting through Ofgem, and Northern Ireland. See thresholds and guidance.
Health regulators and the Cyber Security and Resilience Bill
NHS England is not the NIS regulator. See who is in each nation, which health bodies are in scope and what guidance is published.
The Information Commission and the Cyber Security and Resilience Bill
The Information Commission regulates digital and managed service providers under the Bill. See its role, its current guidance and what is still missing.
Ofcom and the Cyber Security and Resilience Bill
Ofcom regulates digital infrastructure and will regulate data centres under the Bill. See who it covers, its current guidance and what is still missing.
Transport regulators and the Cyber Security and Resilience Bill
Who regulates air, rail, road and water transport under NIS and the Bill: the Transport Secretary, CAA, Scottish Ministers and Northern Ireland.
More sectors
Charities and housing associations under the Cyber Security and Resilience Bill
Charities and housing associations are not regulated sectors under the Bill. See what could bring you into scope and how supplier duties will affect you.
Defence suppliers under the Cyber Security and Resilience Bill
Defence is not a regulated sector under the Bill, but defence suppliers can still be caught through managed services, data centres or designation.
IT resellers and consultancies under the Cyber Security and Resilience Bill
Where the RMSP definition starts and stops for IT resellers, break-fix firms and consultancies, with a practical test for each type of service.
Load controllers explained
What a load controller means under the Cyber Security and Resilience Bill: the 300 MW test, appliances that count, intermediaries and the separate licence.
Manufacturing under the Cyber Security and Resilience Bill
Manufacturing is not a regulated sector under the Bill, but suppliers, energy device firms and in-house data centres can still be caught. See the routes.
NHS cyber standards and the Cyber Security and Resilience Bill
How the NHS Data Security and Protection Toolkit, the Cyber Assessment Framework and the Cyber Security and Resilience Bill fit together.
Retail and e-commerce under the Cyber Security and Resilience Bill
Retail is not a regulated sector under the Bill. See the routes that can still catch retailers, from online marketplaces to supplier designation.
Schools and academy trusts under the Cyber Security and Resilience Bill
Most schools and trusts will not be directly regulated by the Bill. See the exceptions, what suppliers must do and which DfE standards already apply.
Security providers under the Cyber Security and Resilience Bill
Whether SOC, MSSP, MDR, penetration testing and incident response providers count as RMSPs under the Bill, and what being in scope would mean.
UK data centre regulations: cyber security and resilience
The cyber security rules for UK data centres: thresholds, Ofcom regulation, reporting and customer notices under the Cyber Security and Resilience Bill.
What is an enterprise data centre?
What enterprise data centre means in everyday use and under UK law, with the 10 MW test, worked examples and the grey areas to check.
Data and evidence
Would the Cyber Security and Resilience Bill have changed these attacks?
Synnovis, Advanced, M&S, Co-op and Jaguar Land Rover assessed against the Bill. What would apply, what would not, and what organisations can learn.
UK cyber attack statistics
Official UK cyber attack statistics from the Cyber Security Breaches Survey 2025/2026 and the NCSC Annual Review 2025, with sources and caveats.
Know where you stand before the duties land.
Take the free readiness assessment to see how your organisation measures up against the Cyber Security and Resilience Bill, or talk to our team about a plan.