What will the Cyber Security and Resilience Bill cost you?
The Government estimates that a typical managed service provider would face about £72,800 in first-year one-off costs and about £93,000 a year in ongoing costs under the Cyber Security and Resilience Bill (CSRB). These are averages rather than a quote, and regulator fees are not included.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What the official figures say
The Government's impact assessment for the Cyber Security and Resilience Bill (CSRB) gives the only official cost estimates we have found. It estimates direct costs to newly regulated businesses at about £125 million a year in total: £120 million for managed service providers and data centres, and £5 million for large load controllers.
These are averages built from surveys of already regulated organisations. They are not a quote, and your own cost could be much higher or lower depending on where you start.
Estimated cost per organisation
Central estimates, in 2025 prices, from the version of the assessment dated 12 November 2025:
| Cost | Managed service provider | Data centre operator | Designated critical supplier |
|---|---|---|---|
| Familiarisation (one-off) | £1,133 | £1,133 | £1,133 |
| Additional physical security (one-off) | £70,281 | £114,454 | £114,451 |
| Contract changes (one-off) | £1,348 | £1,348 | £1,644 |
| Additional cyber security spending (yearly) | £92,635 | £181,464 to £211,363 | £190,435 |
| Reporting compliance to the regulator (yearly) | £519 | £519 | £519 |
The managed service provider figure of £92,635 adds the assessment's £64,460 internal and £28,175 external costs. The assessment borrows these from digital service providers, because it treated them as the closest evidence. Critical supplier figures borrow from operators of essential services because their duties have not yet been set.
The smaller line items
- Reporting an incident: £89 per incident, based on about two hours of staff time. The central scenario assumes seven incidents a year, or 16 for data centres.
- Being ready to report at any time: an average of about £9,000 per firm in 2026 for weekend cover, rising to about £14,000 by 2036. This applies to existing and newly regulated firms.
- Existing regulated firms: £380 per firm to get familiar with the new reporting rules.
What the figures leave out
Regulator charges. The Bill lets regulators recover their costs, including through charging schemes. The assessment does not put a figure on this because charges depend on each regulator's future scheme. See cost recovery for what can be charged.
Fines and national security directions. The cost of complying with a direction under Part 4 is not estimated.
Future security rules. Secondary legislation could set more specific requirements. The assessment lists security and resilience requirements as a non-monetised measure.
Indirect costs. The assessment has no figure for smaller suppliers who take on new requirements through customer contracts.
Your starting position. The figures do not reflect your own gaps. A provider with a mature security team and a 24-hour operations function will spend differently from one that has neither.
How to build your own estimate
Do not budget from the averages alone. Use them as a sense check and work through these in order.
- Confirm which category you are in. Use OES vs RDSP vs RMSP. Being out of scope changes everything.
- Assess your gaps. Start with the readiness assessment, then assess against the Cyber Assessment Framework if you expect it to be used.
- Price round-the-clock cover. The 24-hour deadline is the requirement most likely to change operating costs. Compare in-house on-call cover with a managed service.
- Review contracts. Include customer notices, supplier terms and audit rights.
- Budget for evidence. Policies, testing, exercises and board reporting all take time.
- Add a line for regulator fees. Treat it as unknown and revisit it when your regulator publishes a scheme.
How reliable are these numbers?
Treat them with care. The assessment is open about relying on proxies and survey evidence, and it says the most significant costs fall on new entities and depend on sensitive assumptions. It also says its reporting compliance figure may be an overestimate because requirements differ by sector.
The number of organisations is also uncertain. The assessment estimates 556 to 1,019 managed service providers in scope, with 788 as its central case, while DSIT's policy statement said 900 to 1,100.
An updated assessment dated 13 May 2026 reflects Commons committee amendments. Check it before you rely on any single figure, because some numbers may have changed. Lords amendments are not reflected.
Sources
Frequently asked questions
The impact assessment’s central estimate is £72,762 in one-off costs, covering familiarisation, physical security and contracts. It adds £92,635 a year for cyber security spending and £519 a year for reporting compliance.
Unknown. The Bill lets regulators recover costs, including through charging schemes, but the impact assessment does not estimate charges because they depend on future schemes.
The assessment estimates about £125 million a year in direct costs to newly regulated businesses. Across all monetised measures it gives a central present-value cost of about £1.2 billion over ten years.
Use them as a rough guide. They rely on survey data and proxies, and an updated version was published in May 2026. Your costs will depend on your current security and the final requirements.