A customer asked about the Cyber Security and Resilience Bill: a supplier’s guide

Where to start

Your customer has probably been told to review their supply chain under the Cyber Security and Resilience Bill (CSRB). They may be regulated, or they may be selling to someone who is. It helps to separate two questions: what the law might require of you, and what your customer wants from you.

Step 1: work out your own status

Possible status	Test	What it means
RMSP	You provide ongoing IT management under contract, with access to systems the customer relies on, and are not micro or small	Direct duties
RDSP	You provide cloud computing, an online marketplace or search engine, and are not micro or small	Direct duties
OES	You meet a Schedule 2 threshold	Direct duties
Critical supplier	A regulator has designated you	Duties follow designation
None of these	Most other suppliers	No direct duty from the Bill, but contract requirements are possible

Designation has safeguards. Before designating you, the regulator must consult others and give you written notice with reasons, and a reasonable period to respond. The test includes supplying a regulated organisation directly, relying on network and information systems to do so, and potential disruption with a significant impact on the economy or day-to-day life. The requirements on critical suppliers will depend on later regulations.

Step 2: find out why they are asking

Reply with some simple questions:

• Do you expect to be regulated under the Bill, and in which category?
• Which service of ours are you concerned about?
• Do you have specific requirements, or is this a general review?
• Do you have a deadline?

The answers often turn a vague request into a few specific needs.

Step 3: reply accurately

You could adapt this:

The Cyber Security and Resilience Bill has not yet become law, and its detailed requirements are still being developed. Based on our current assessment, we do not expect to be regulated directly as [an RMSP/RDSP/OES], and we have not been designated as a critical supplier. We will review this as the law develops. We understand you may have your own duties, and we can support you with: [security evidence], [named incident contact], and [incident notification commitment].

Only say this if it is true, and have someone check it if the question matters commercially. If you are likely to be regulated, say so and explain your preparation plan.

Step 4: offer evidence you already have

• Certificates, such as Cyber Essentials or ISO 27001, with their scope.
• Recent test summaries, without sensitive detail.
• Your incident process, including how and when you tell customers.
• A named security contact, with an out-of-hours route.
• Key sub-suppliers, if customers need to see who else has access.

Step 5: watch the contract

Customers may ask you to take on obligations. Look closely at:

• "Comply with the Bill." This may import duties that do not otherwise apply to you, and may be impossible to meet while the law is unsettled.
• Very short notification deadlines. A regulated customer's 24-hour clock does not automatically mean you can notify within an hour.
• Audit rights. Agree scope, frequency and confidentiality.
• Uncapped liability. Fines and incident costs can be large, so take legal advice.

Sources

• The Bill as brought from the Commons (HL Bill 32), regulations 14H and 14J
• Hill Dickinson: update on the Bill
• Risk Ledger: the Bill and supply chains
• ISMS.online: supplier governance