MSP compliance checklist for the Cyber Security and Resilience Bill
If you are a relevant managed service provider under the Cyber Security and Resilience Bill (CSRB), you will need to register with the Information Commission, manage security risks, report significant incidents within 24 and 72 hours, and notify affected UK customers. This checklist puts those duties in order.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
How to use this checklist
This puts the Cyber Security and Resilience Bill (CSRB) duties for managed service providers into a working order. The Bill is not yet law, so treat dates and detail as provisional. For the legal detail behind each step, see the managed service providers reference page.
Step 1: Confirm you are in scope
- Does a contract with a customer require you to provide ongoing management of IT systems, such as support, maintenance, monitoring or active administration?
- Do you or your subcontractors connect to or access systems the customer relies on, on site or remotely?
- Do you provide that service in the UK? It doesn't matter where you are established.
- Are you above the micro or small enterprise limits, counting linked and partner businesses?
- If you are subject to public authority oversight, do you earn more than half of your income from commercial activities?
- Record the decision, reasons and date, and review it after any acquisition or new service line.
Step 2: Prepare your registration
Register with the Information Commission within 3 months of the relevant section coming into force, or within 3 months of first meeting the conditions if that is later. Collect:
- Your name and proper address, which is usually your registered or principal office.
- The names of your directors, or of partners or those managing a partnership.
- Up-to-date contact details, including email addresses and phone numbers.
Give one person responsibility for updates. Changes must be notified as soon as reasonably practicable, and within 7 days. The Commission must share the register with GCHQ.
Step 3: Nominate a UK representative, if needed
If your principal office is outside the UK, nominate a UK representative in writing and notify the Commission of their name, email address and phone number. The same 3-month and 7-day periods apply. Nominating a representative doesn't protect you from legal action against the company.
Step 4: Manage security risks
Regulation 14B requires appropriate and proportionate measures to manage risks to the systems you rely on to provide managed services in the UK. Those measures must, having regard to the state of the art, ensure security appropriate to the risk, and prevent and minimise the impact of incidents. You must also have regard to Information Commission guidance.
The Bill's text doesn't list specific controls. Until guidance arrives, our suggested minimum for an MSP is:
- A risk assessment covering every system used to reach customers.
- Multi-factor authentication and privileged access control for remote tools and admin accounts.
- Separation between customer environments.
- Logging and monitoring of remote access and tool use.
- Patching and vulnerability management for your own platforms.
- Backups and tested recovery for the systems you rely on.
- A supplier risk review, including your remote management and security tool vendors.
- Mapping against a recognised framework, such as the Cyber Assessment Framework.
Step 5: Build incident reporting
- Set internal triggers for the significant incident test, using the factors for RMSPs, including impact on customers' systems.
- Send the initial notification to the Information Commission within 24 hours of first awareness.
- Send the full notification within 72 hours of the same moment, not 72 hours after the first notice.
- Copy the CSIRT on both at the same time.
- Provide 24/7 cover, with named deputies and a route to reach your regulator if your systems are down.
- Adapt the runbook and templates.
- Say in a full notification if the incident was caused by one at another regulated person.
Step 6: Prepare customer notices
After the full notification, as soon as reasonably practicable:
- Take reasonable steps to identify UK customers likely to be adversely affected.
- Consider disruption to their service, compromise of their data and any impact on their own systems.
- Notify them, giving the nature of the incident and why you think they are likely to be affected.
To do this quickly, keep an up-to-date map of which customers rely on which systems and tools. Prepare wording in advance, and check it fits your contract notice terms.
Step 7: Review contracts
These are our suggestions, as the Bill doesn't prescribe contract terms.
- Compare existing incident notice clauses with the Bill's process and your customers' own duties.
- Check who pays for extra audit or evidence requests.
- Make sure subcontractors must tell you about incidents quickly enough for you to meet your 24-hour deadline.
- Be careful with absolute security promises you can't evidence.
Step 8: Keep evidence
You may need to show a regulator what you did. The Bill includes information notice and inspection powers, so keep:
- Your scope decision and registration record.
- Risk assessments, reviews and senior sign-off.
- Records of incident decisions, including events you decided not to report.
- Exercise results and lessons learned.
- Details of supplier reviews.
Step 9: Budget for regulation
Regulators can charge for their relevant costs through charging schemes. Amounts aren't set in the Bill. See cost recovery.
What failure could cost
| Failure | Maximum penalty for an undertaking |
|---|---|
| Security duties, incident notification, customer notices and certain directions | The greater of £17 million and 4% of turnover, inside and outside the UK |
| Registration, UK representative and copying the CSIRT | The greater of £10 million and 2% of turnover, inside and outside the UK |
A penalty must be appropriate and proportionate, having regard to the impact of the failure, steps to remedy it and your compliance history. See fines and penalties.
Sources
Frequently asked questions
Registering with the Information Commission, taking appropriate and proportionate security measures, notifying significant incidents within 24 and 72 hours, copying notifications to the CSIRT, notifying affected UK customers and, for providers with a principal office outside the UK, nominating a UK representative.
The Information Commission is the regulator for relevant managed service providers.
Serious failures, including security and incident notification failures, carry a maximum of the greater of £17 million and 4% of turnover. Administrative failures, including registration failures, carry a maximum of the greater of £10 million and 2% of turnover.
The Bill’s text requires appropriate and proportionate measures having regard to the state of the art, and regard to Information Commission guidance. Check any guidance or secondary legislation when it is published, as requirements may become more specific.