Cyber Security and Resilience Bill summary
The Cyber Security and Resilience Bill (CSRB) updates the UK’s NIS Regulations 2018. It would bring in data centres, larger managed service providers and large load controllers, require faster incident reporting, strengthen enforcement and give ministers powers to update the regime. It is not yet law.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Report Stage update: VinciWorks reports that Government amendments on 26 October 2026 narrowed the incident definition to incidents that have actually adversely affected systems, and removed mandatory near-miss reporting for data centre operators. We could not check this against the amended Bill, so the wording below reflects HL Bill 32 and may be out of date. See what Parliament changed.
The Bill on one page
What it is: the Cyber Security and Resilience Bill (CSRB), formally the Cyber Security and Resilience (Network and Information Systems) Bill, is UK legislation that updates the Network and Information Systems Regulations 2018. It does not replace them outright.
Why it exists: to widen the regulated perimeter, get earlier information about incidents, and strengthen regulators, while giving ministers powers to update the regime and respond to national security threats.
Where it stands: not yet law. Lords Third Reading was scheduled for 2 November 2026. The Commons must then consider Lords amendments. Check the timeline for the latest.
How it is organised
The print brought from the Commons has five Parts and 61 sections.
| Part | What it does |
|---|---|
| Part 1 | Introduction and overview |
| Part 2 | Amends the NIS Regulations: who is regulated, reporting, costs, information and enforcement |
| Part 3 | Powers for the Secretary of State: regulations, a statement of strategic priorities, a code of practice and a report on the legislation |
| Part 4 | National security directions to regulated persons and regulators |
| Part 5 | Extent, commencement and short title |
Who it adds
- Data centres at 1 megawatt or more of rated IT load, or 10 megawatts for enterprise data centres. Ofcom is the proposed regulator.
- Large load controllers with 300 megawatts or more of potential electrical control over relevant energy smart appliances.
- Relevant managed service providers, meaning providers of ongoing IT management with access to customers' systems, unless they are micro or small enterprises. The Information Commission is the regulator.
- Critical suppliers designated by a regulator where disruption could have a significant impact on the economy or day-to-day life.
Existing operators of essential services and relevant digital service providers stay in scope, with changed duties. See OES vs RDSP vs RMSP.
What changes in practice
- Faster incident reporting. Initial notification within 24 hours and full notification within 72 hours of first becoming aware. Both go to the regulator and are copied to the CSIRT.
- A wider definition of incident. It covers events having, or capable of having, an adverse effect on operation or security. Separate tests decide what must be reported. See what counts as a significant incident.
- Customer notification. Data centres, digital service providers and managed service providers must notify UK customers likely to be adversely affected.
- Stronger enforcement. Maximum penalties are the greater of £17 million and 4% of turnover for serious failures, and the greater of £10 million and 2% for lesser failures. Part 4 has its own penalty rules.
- Cost recovery. Regulators get powers to impose charges. See cost recovery.
- More information sharing between regulators and other bodies.
- Future change without a new Act. Ministers can make regulations on security requirements, subject to Parliamentary procedure.
When it starts
Not all at once. Some provisions start on Royal Assent and some two months later, while the main duties on organisations start on dates set by regulations. See when the Bill comes into force.
What it does not do
- It does not make every business a regulated organisation.
- It does not make banks a new NIS subsector.
- It does not amend the Computer Misuse Act 1990.
- It does not, in the print brought from the Commons, impose personal penalties on directors for failing the NIS duties.
What is still moving
The Lords voted against the Government on 26 October 2026 on a statutory review and on a register of foreign powers. Those changes could be reversed or altered when the Commons considers them. Much of the detail will also come later, through regulations, regulator guidance and any code of practice.
Five questions for your organisation
- Do any of our services meet a regulated definition?
- Do our suppliers, and could we be seen as critical to a regulated customer?
- Could we send a notification within 24 hours, at any time of day?
- Could we identify which UK customers an incident affects?
- Does a named senior person own this work?
The free readiness assessment can help you start.
Need the full text?
You can read the Bill or see what the Bill changes in more detail.
Sources
Frequently asked questions
It is a UK Bill that updates the NIS Regulations 2018. It widens who is regulated, shortens incident reporting deadlines, strengthens regulators and lets ministers update the rules through regulations.
No. Lords Third Reading was scheduled for 2 November 2026, and the Commons must then consider Lords amendments before Royal Assent.
Operators of essential services, relevant digital service providers, relevant managed service providers and designated critical suppliers. It adds data centres and large load controllers as essential services.
You can read the print brought from the Commons on our View the Bill page. Later Lords amendments mean the final text may differ.