The Government Cyber Action Plan and the Bill
The Government Cyber Action Plan is a programme to improve security across departments and the public sector, backed by over £210 million. The Cyber Security and Resilience Bill (CSRB) is legislation focused mainly on essential and digital service providers. Public bodies and suppliers can be affected by both.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
The Government Cyber Action Plan and the Cyber Security and Resilience Bill (CSRB) are parallel measures. The plan, published on 6 January 2026, is the Government's programme for improving security in its own departments and the wider public sector. The Bill is legislation aimed mainly at organisations that run essential and digital services, and at their suppliers.
One is a programme backed by money and central direction. The other creates legal duties and fines.
How they compare
| Government Cyber Action Plan | Cyber Security and Resilience Bill | |
|---|---|---|
| What it is | Government plan | Proposed Act of Parliament |
| Main audience | Government departments and the wider public sector | Operators of essential services, digital and managed service providers, data centres, load controllers and critical suppliers |
| Funding or sanction | Backed by over £210 million | Fines and enforcement by regulators |
| Central body | New Government Cyber Unit | Sector regulators, with the Secretary of State's powers |
| Status | Published | Not yet law |
What the plan does
According to the Government's announcement, the plan:
- is backed by more than £210 million
- creates a Government Cyber Unit to coordinate risk management and incident response across departments
- includes a team to oversee severe, complex risks that no single organisation can handle alone
- holds organisations accountable for fixing vulnerabilities
- requires departments to have robust incident response arrangements
It updates the Government's earlier approach to public sector cyber security, and sits under the Department for Science, Innovation and Technology. Some critics, quoted in trade press, say the funding looks small against the size of public sector networks.
Does the Bill apply to public bodies?
This is where people often go wrong, because the answer isn't a simple yes or no.
Government's framing. Its announcement describes the Bill's expectations as aimed at firms that provide services to government, including energy, water, healthcare and data centre providers.
The Bill's text. Some public organisations could still be caught, depending on what they do. An essential service provider above a threshold is not excluded just for being public. For RDSPs and RMSPs, there is a separate public authority oversight test, under which a body controlled by a UK public authority is only caught if it gets more than half of its income from commercial activity.
Read public services, local councils and NHS organisations for how this plays out. Parliament also debated whether the public sector should be more directly covered, so read the final Act.
What this means for public bodies
The Bill may not apply directly, but you are not off the hook. You may be subject to the plan or to central requirements. You may also rely on suppliers who become regulated.
- Work out your position. Are you a department, a wider public body or an operator of essential services?
- Follow requirements issued by government. Confirm which standards and reporting routes apply to you.
- Strengthen incident arrangements. Know who you'd contact and who could help out of hours.
- Review supplier contracts. A regulated supplier's duties may change how it notifies you. You'll probably want contract terms that are faster than the legal minimum.
- Fix known vulnerabilities. Accountability for remediation is a clear theme, so track ownership and deadlines.
- Use the CAF. It offers a shared language, whichever regime applies.
What this means for suppliers to government
The two measures can reach you from both sides.
- The Bill may regulate you directly if you are a managed service provider, a data centre or a cloud provider above the relevant limits.
- A public sector customer working under the plan may ask for stronger security, evidence and incident response in contracts.
- You could also be considered for designation as a critical supplier if you supply a regulated organisation directly and the test is met.
Prepare one set of evidence you can reuse for regulators and public sector buyers.
What to watch
- How the Government Cyber Unit's requirements develop.
- Whether Part 3 regulations under the Bill reach further into the public sector.
- Ransomware payment proposals, which would cover the public sector more directly.
Sources
Frequently asked questions
A plan published on 6 January 2026, backed by over £210 million, to strengthen public sector cyber security and set up a Government Cyber Unit.
No. They were announced as parallel measures. The plan is not an Act and does not create the Bill’s penalties.
The Government describes the Bill’s expectations as aimed at firms providing services. Public bodies’ position depends on what they do, so read the final Act and our public services guide.
Check whether the Bill regulates you directly, and prepare for stronger security and incident terms from public sector customers.