Managed security services contracts: what to review for the Bill
The Cyber Security and Resilience Bill (CSRB) does not prescribe contract terms, but its deadlines change what your contract needs. Focus on incident alerts, responsibilities, logs, audit rights, subcontractors, regulatory change, liability and exit. This is general information, so have a solicitor review actual clauses.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short version
The Cyber Security and Resilience Bill (CSRB) doesn't prescribe a managed security services contract. It does change what a contract needs to do, because in-scope providers will have fixed reporting deadlines and regulated customers will need to manage supplier risk.
Use this guide to prepare for a review with your legal and security teams. It's general information, not legal advice or model wording. Have a solicitor draft and review actual clauses, especially liability, indemnities, data protection and termination.
First: work out each party's status
Before reviewing clauses, record these in the contract file:
- Is the provider likely to be a relevant managed service provider (RMSP)? A service qualifies if it involves ongoing management of a customer's IT systems under contract, with access to systems the customer relies on. Security monitoring or active administration may qualify. Micro and small enterprises are excluded.
- Is the customer regulated? It could be an operator of essential services (OES), a relevant digital service provider (RDSP) or an RMSP itself.
- Could the provider be designated as a critical supplier? Designation applies to suppliers that aren't already regulated for that service.
The answers shape who needs what from whom.
Clauses to review
Security obligations
Vague promises to follow "industry best practice" are hard to measure. Consider:
- specific controls for the provider's own access to customer systems, such as multi-factor authentication, privileged access management and logging
- security of the provider's remote management tools
- standards or certifications the provider will maintain
- what happens if a certification lapses
- how requirements can change as regulator guidance appears
An RMSP's own duty covers measures appropriate to the risk, having regard to the state of the art, and regard to Information Commission guidance. That guidance isn't all published yet, so include a route for updating the contract.
Incident notification between the parties
This is the clause most likely to need rewriting. Both 24-hour and 72-hour deadlines run from when a regulated organisation first becomes aware of a reportable incident.
Consider setting:
- a time limit for the provider to alert the customer, shorter than the customer's own deadline
- what counts as an alert, including suspected incidents
- 24-hour contacts on both sides
- what information must be included, and when updates follow
- who can make statements to regulators and the public
Check how the provider's statutory customer notice fits in. The Bill requires an RMSP to notify likely affected UK customers as soon as reasonably practicable after its full notification, which may be later than a customer needs. A contract can require earlier warning.
Responsibilities matrix
Attach a schedule showing who owns each activity: detection, triage, containment, patching, backups, identity, log retention and regulator contact. Include what the service doesn't cover. Gaps here cause many disputes.
Evidence and logs
Customers need evidence for regulators and investigations, so cover:
- log types and retention periods
- customer access, including after the contract ends
- preservation of evidence during an incident
- format and speed of delivery
- help responding to regulator information notices
A regulator's information notice can require someone to obtain or generate information, so don't assume existing reports will be enough.
Audit and assurance
Consider:
- right to audit, or agreed alternatives such as independent reports and penetration test summaries
- help with customer assessments, including against the Cyber Assessment Framework where relevant
- notice periods and costs
- cooperation with regulator inspections
Subcontractors and supply chain
Ask for:
- a list of subcontractors with access to customer systems or data
- notice of changes, and a right to object
- flow-down of security and notification terms
- the provider's duty to manage its own suppliers
- notice if the provider or a key supplier is designated as a critical supplier
Regulatory change and costs
The Bill allows regulators to charge for their costs, and more detail is coming through secondary legislation. Decide:
- who bears costs of complying with new rules
- whether regulator charges can be passed on
- how the contract changes if requirements change
- whether either party can exit if the changes are significant
Liability, indemnities and insurance
Review with a solicitor:
- liability caps, and whether data breach losses have a separate cap
- excluded losses, such as loss of profit or data
- indemnities
- insurance types and levels the provider must hold
- whether regulatory fines can be recovered at all
Don't assume regulatory fines can be passed to another party or insured. That's an unsettled area where the answer can depend on the facts. Terms limiting liability may also be subject to the Unfair Contract Terms Act 1977.
Data protection
If the provider handles personal data, UK GDPR generally requires a written processing contract, including security and breach assistance terms. Keep this consistent with the incident clause, so it doesn't set a different timescale by accident.
Termination and exit
Consider:
- transition help and timelines
- removal of provider access
- return or deletion of data and logs
- termination rights after serious incidents or regulatory action
Security monitoring is hard to replace quickly, so test the exit plan in practice.
A quick review checklist
- Status of both parties recorded
- Provider alert time is shorter than the customer's reporting deadline
- Out-of-hours contacts named and tested
- Responsibilities matrix attached
- Logs and evidence access secured, including after exit
- Audit or assurance route agreed
- Subcontractors listed and terms flowed down
- Change route agreed for new regulations and guidance
- Liability, indemnity and insurance reviewed by a solicitor
- Data processing terms consistent with incident terms
When to do this
Many contracts will renew before the main duties start, so don't wait for commencement. Add a regulatory change clause to any multi-year deal signed now. NCSC supply chain guidance suggests reviewing contracts on renewal, or sooner for critical suppliers.
If you're choosing a provider as well, the same points make good questions at procurement stage.
Sources
Frequently asked questions
The text we reviewed does not prescribe contract terms for managed services. It sets duties that a contract should support, such as incident notification and security measures.
There is no single answer. Set a period shorter than the customer's own reporting deadline, and include suspected incidents where appropriate.
Often not. Under the Bill it follows the provider's full notification to the regulator, which may be too late for the customer's own deadlines. A contract can require earlier warning.
This is unsettled and depends on the facts and contract. Take legal advice before relying on it.