The first 90 days after the Cyber Security and Resilience Bill duties start
Your clock starts when the relevant section of the Cyber Security and Resilience Bill (CSRB) comes into force, not on Royal Assent. No start date has been set, so this plan counts from day 0 of commencement, with the three-month registration deadline as the main milestone.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Start from commencement, not a calendar date
The Cyber Security and Resilience Bill (CSRB) has no fixed date for its main duties. Section 60 leaves them to regulations, which can set different days for different purposes. So this plan uses day 0 to mean the day a given duty starts. The steps and timings are our suggestions, except where marked as a legal deadline.
The legal deadline for RDSP and RMSP registration is three months from section 14 starting, or from the day you first meet the conditions if that is later.
Before day 0
- Read the commencement regulations. Note the date for each duty, not just one date for "the Act".
- Decide your category. Record your reasoning for OES, RDSP or RMSP, or why you are out of scope.
- Check the final text. Regulation numbers and some incident wording may have changed since HL Bill 32.
- Name an owner and a deputy. One senior person should be accountable, with cover for out-of-hours incidents.
Days 0 to 7
- Assume reporting is live if that duty has started. Check the 24-hour runbook works, and that on-call staff know it.
- Find the regulator's channel. Look for the required form and manner of notifications.
- Check for grace periods. Do not assume any, and check the transitional provisions.
- Brief the board. Confirm the category, duties, deadline and owner.
Days 8 to 30
- Gather registration details. Name, proper address, directors or partners, and contact details with email addresses and phone numbers.
- Nominate a UK representative if your principal office is outside the UK. See UK representatives.
- Map customers. You need to be able to tell quickly which UK customers an incident is likely to affect. See customer notification.
- Compare your controls to guidance. Use your regulator's guidance, and the Cyber Assessment Framework if your regulator uses it.
Days 31 to 60
- Run a timed exercise. Include the decision on whether an incident is reportable, the 24-hour notice, the 72-hour report and customer notices.
- Review supplier contracts. Ask whether suppliers will tell you about incidents quickly enough for your own deadlines.
- Budget for charges. Check any charging scheme from your regulator.
- Fix the biggest gaps. Prioritise controls that affect detection, containment and access.
Days 61 to 90
- Register early. Do not leave it to the deadline, which is a legal requirement and carries penalty risk.
- Set up change tracking. RMSPs and RDSPs must report changes to registration details within 7 days of the change taking effect.
- Keep your evidence. Save your scope reasoning, exercises, decisions and board papers.
- Schedule a review. Revisit your plan when new regulations, codes or guidance appear.
Who to involve
| Role | What they cover |
|---|---|
| Accountable executive | Decisions, budget and board reporting |
| Security lead | Controls, detection and the incident runbook |
| Legal or compliance | Scope reasoning, contracts and the final text |
| Service delivery | Customer lists, tools and who can access what |
| Communications | Customer notices and media handling |
A smaller provider may have one person covering several roles. Even then, name a deputy for reporting, because the 24-hour clock does not wait for someone to return from leave.
Penalties to keep in mind
Under HL Bill 32, registration failures fall in the standard band: the greater of £10 million and 2% of turnover. Security and incident notification failures fall in the higher band: the greater of £17 million and 4% of turnover. These are maximums. See fines and penalties.
Sources
- The Bill as brought from the Commons (HL Bill 32), including sections 14 and 60 and regulations 14C and 18
- Government RMSP factsheet
Frequently asked questions
This plan counts from the day the relevant duty starts. For registration, that is the day section 14 comes into force, or the day you first meet the conditions if later. Three calendar months is not always exactly 90 days, so use the actual legal deadline.
Not for the main duties. Section 14 and the reporting duties are not in the fixed commencement lists, so they start on dates set by regulations.
Not necessarily. Regulations can set different days for different purposes, so check each duty separately.
No. Reporting duties may not give you any grace period once they start. Prepare your category, contacts and runbook beforehand.