The Cyber Security and Resilience Bill impact assessment explained
The Government’s impact assessment for the Cyber Security and Resilience Bill (CSRB) estimates a net present social value of -£1.2 billion over ten years. It is negative mainly because the main benefit, avoided cyber attacks, could not be given a number.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What an impact assessment is
An impact assessment is the Government's own estimate of what a law will cost and what it should achieve. The one for the Cyber Security and Resilience Bill (CSRB) was prepared by the Department for Science, Innovation and Technology (DSIT) and looks at the period from 2026 to 2035.
It is a useful source for scale and assumptions, but it is not part of the law and creates no duties.
The headline result
The assessment's best estimate of net present social value is -£1,201 million, within a range of -£766 million to -£1,740 million.
That looks alarming, but it needs context. The figure is negative largely because the costs are counted while the main benefit, fewer and less damaging attacks, is not. DSIT says it could not estimate how many attacks would be avoided. So this number does not mean the Government expects the Bill to leave the UK £1.2 billion worse off once all benefits are included.
The Regulatory Policy Committee, which reviews these assessments, also questioned whether the calculations fully capture the impact of the Bill's many measures.
Where the costs fall
| Measure | Present value, central estimate | Range |
|---|---|---|
| Bringing managed service providers into scope | £796m | £552m to £1,058m |
| Improving incident reporting | £201m | £58m to £384m |
| Bringing data centres into scope | £149m | £118m to £214m |
| Bringing large load controllers into scope | £40m | £27m to £64m |
Several measures have no figure at all. They include critical supplier designation, cost recovery, stronger enforcement, future security requirements and national security directions. Some depend on secondary legislation that does not exist yet.
For a per-organisation view, see what the Bill will cost you.
How many organisations it expects to catch
| Group | Central estimate |
|---|---|
| Managed service providers | 788, in a range of 556 to 1,019 |
| Data centre operators | 64 |
| Large load controllers | 11 |
| Designated critical suppliers | 93, in a range of 56 to 130 |
| Organisations already regulated | 1,128 |
The managed service provider range starts from research that identified 1,214 providers meeting a size test, then removes 658 that are likely to be already regulated as cloud providers. DSIT's policy statement gave a different estimate of 900 to 1,100. The gap shows how uncertain this market is.
The critical supplier estimate is extrapolated from evidence given by two regulators, so treat it as a rough guide.
The case it makes for the Bill
The assessment cites a KPMG estimate that cyber attacks cost UK businesses £14.7 billion a year, about 0.5% of GDP.
Because it cannot estimate avoided attacks, it uses a break-even approach. Newly regulated businesses bear an estimated £125 million in annual direct costs. If each of them suffered just one attack in a year, the assessment's indicative cost would be about £943 million. Its argument is that preventing a fraction of attacks could justify the cost.
This is an illustration, not a forecast, and the cost-per-attack assumption is itself an estimate.
Why it matters if you are affected
It shows what the Government assumed about you. The assessment's assumptions include seven incidents a year for a typical newly regulated firm and 16 for a data centre. If your experience differs, that is useful evidence when you respond to a consultation.
It flags later decisions. It identifies measures that depend on secondary legislation. Those decisions are where costs could change most. Our compliance guide covers what to do now.
It reveals the likely regulator load. The assessment shows regulators increasing from 12 to 13, with new responsibilities for managed services and data centres.
Limits to keep in mind
- This summary uses the version dated 12 November 2025. An update dated 13 May 2026 reflects amendments made in Commons committee, and we could not retrieve it to compare every figure.
- It does not reflect amendments made in the Lords, including those on AI and the register of foreign powers.
- Many costs rely on proxies from digital service providers and operators of essential services.
- Figures are in 2025 prices.
Sources
Frequently asked questions
Because costs were monetised while the main benefit, fewer and less damaging attacks, was not. The Government says it could not estimate how many attacks would be avoided.
Its central estimate is 788, in a range of 556 to 1,019. DSIT’s policy statement gave a different figure of 900 to 1,100.
No. It is the Government’s analysis and creates no duties.
No. The version we reviewed is dated November 2025, with an update in May 2026 for Commons committee changes. Lords amendments came later.