Does the Cyber Security and Resilience Bill apply to small businesses?
Usually not directly. Micro and small enterprises cannot be regulated as digital or managed service providers under the Cyber Security and Resilience Bill (CSRB), but that exclusion does not cover every route, and customers may still pass requirements down to you.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer by route
The Cyber Security and Resilience Bill (CSRB) has no single small business exemption. The size test sits inside two definitions only, so the answer depends on how you could come into scope.
| Route into scope | Does being micro or small take you out? | What decides it |
|---|---|---|
| Relevant managed service provider (RMSP) | Yes | The definition excludes micro and small enterprises |
| Relevant digital service provider (RDSP) | Yes | The definition excludes micro and small enterprises |
| Data centre operator | No | Rated IT load: 1 MW, or 10 MW for an enterprise data centre |
| Other operator of essential services (OES) | Not by this exclusion | The sector threshold in Schedule 2 of the NIS Regulations, or designation by a regulator |
| Critical supplier | Not by this exclusion | Designation under regulation 14H, based on the potential for disruption |
Most small businesses are not data centre operators or essential service operators, and few are likely to be designated as critical suppliers. For them, the main effect is likely to come through customers. That last point is our reading, as designation decisions have not yet been made.
How to test whether you are micro or small
The Bill uses Commission Recommendation 2003/361/EC. You must meet the staff test and at least one of the two money tests.
| Category | Staff | Annual turnover | Annual balance sheet total |
|---|---|---|---|
| Micro | Fewer than 10 | Up to €2 million | Up to €2 million |
| Small | Fewer than 50 | Up to €10 million | Up to €10 million |
Example, our reading: a company with 40 staff, €14 million turnover and a €6 million balance sheet meets the staff test and the balance sheet test, so it looks small on its own figures.
Check your group before relying on the exemption
This is the step most easily missed. The Recommendation does not always look at one company alone.
- Linked enterprises: if one business controls another, such as by holding a majority of voting rights, the linked business's figures are added in full.
- Partner enterprises: if a business holds 25% or more of the capital or voting rights in another, figures are added in proportion to that holding. Some investors, such as certain business angels and universities, can be excluded from this test.
So a 30-person MSP owned by a large group may not count as small, even though it looks small on its own accounts.
The Bill's text does not explain how these rules, written in euros for EU purposes, will be applied in the UK. Guidance may clarify this. Keep a dated note of your calculation, and revisit it if you grow, are acquired or restructure.
How the Bill can still reach you
Being outside the definitions does not stop the Bill affecting you.
- Customer contracts: regulated customers must manage security risks, so they may ask suppliers for security commitments, evidence or faster incident notice. These would be contractual requirements, not duties owed to a regulator.
- Critical supplier designation: a regulator can designate a direct supplier to a regulated organisation if an incident at the supplier could cause disruption with a significant impact on the economy or day-to-day functioning of society. It must consider whether the customer could get the goods or services elsewhere. A niche, hard-to-replace supplier is therefore more exposed than a large one with many competitors.
- Growth: an RMSP or RDSP generally has three months to register from first meeting the conditions, so crossing a size threshold starts a clock.
What to do now
- Work out which routes could apply to you, using the table above.
- Calculate your size, including linked and partner businesses, and keep the working.
- List your regulated customers and any requests they have made.
- Check whether you are hard to replace for any customer in an essential service.
- Prepare a short pack for customers: your certifications, incident contact and notification commitments.
- Consider a baseline such as Cyber Essentials. The Bill does not require it, but customers may ask for it.
If you are not sure which category applies, read OES vs RDSP vs RMSP or see the full sector list.
Sources
Frequently asked questions
The Bill uses Commission Recommendation 2003/361/EC. A small enterprise has fewer than 50 staff and turnover or a balance sheet total of no more than €10 million. A micro enterprise has fewer than 10 staff and turnover or a balance sheet total of no more than €2 million.
A micro or small enterprise is outside the definition of a relevant managed service provider, so it does not take on those duties directly. Check linked and partner businesses first, because the Recommendation can count them when measuring size. Customers may still ask for security commitments by contract.
The micro and small exclusion is written into the RDSP and RMSP definitions. The critical supplier test in regulation 14H has no equivalent size exclusion. It depends on whether disruption to the supplier could have a significant impact on the economy or society.
Data centres are caught by rated IT load rather than company size: 1 megawatt, or 10 megawatts for an enterprise data centre. A company can be small and still run a data centre above those thresholds.