# NIS Regulations 2018 as amended by the Cyber Security and Resilience Bill: a Keeling schedule — Cyber Security and Resilience Bill

> This Keeling-style schedule shows how key NIS Regulations 2018 provisions would read if the Cyber Security and Resilience Bill (CSRB) passed as HL Bill 62. It quotes the current text from legislation.gov.uk and the amending text from the Bill, with the amending clause for each. No official Keeling schedule has been published for HL Bill 62.

Canonical page: https://cybersecurityandresiliencebill.com/guides/nis-regulations-keeling-schedule
Updated: 2026-11-09

Status checked 13 November 2026: the Bill passed the House of Lords on 2 November 2026 and returns to the Commons, which is due to consider the Lords amendments on 24 November 2026. On 4 November 2026 the Commons extended its carry-over, so it lapses if not passed by the end of 29 April 2027. It is not yet law. References are to HL Bill 62 (as amended on Report), so wording and numbering may still change in the final Act. This guide is general information, not legal advice.

## Key points

- Covers reg 1 (interpretation), reg 10 and 12 (security duties), reg 11 and 12 (incident reporting), the new MSP and data centre provisions, and reg 18 (penalties). Other regulations are not covered.
- Incident reporting would move from a single 72-hour notice to a 24-hour initial notification and a 72-hour full notification, both counted from first awareness (clause 15).
- Reg 18's £1m, £8.5m and £17m tiers would become a standard maximum (greater of £10m and 2% of turnover) and a higher maximum (greater of £17m and 4%) (clause 21).
- The Government's official Keeling schedules track Bill 329 (22 January 2026) and HL Bill 32 (17 June 2026), not the Lords amendments in HL Bill 62.
- None of these amendments applies on Royal Assent. Part 2 commences on days set by regulations under clause 69(3).

## What this schedule covers, and what it does not

This page shows how selected provisions of the [Network and Information Systems Regulations 2018](https://www.legislation.gov.uk/uksi/2018/506/contents) (SI 2018/506) would read if the Cyber Security and Resilience Bill (CSRB) were passed in the form of **HL Bill 62**, the print as amended on Lords Report on 26 October 2026. It is an unofficial working document, prepared by us from the two primary sources, and it is not legal advice.

**Covered (in this order):**

| NIS provision | Topic | Amended by (HL Bill 62) |
|---|---|---|
| Reg 1 | Interpretation: "incident", "cloud computing service", RDSP, RMSP, "managed service", "critical supplier", CSIRT and SPOC | Clauses 7, 9, 11, 12, 15(2); Schedule 2 para 2 |
| Reg 10 | Security duties of operators of essential services (OES) | Schedule 2 para 8 |
| Reg 12 and new reg 14B | Security duties of relevant digital service providers (RDSPs) and relevant managed service providers (RMSPs) | Clauses 8, 10, 15(4) |
| Reg 11 and new regs 11A, 11B, 12A, 12B, 14E, 14F | Incident reporting | Clause 15 |
| New regs 11C, 12C, 14G | Notifying customers | Clause 16 |
| NIS Schedule 2 para 11, reg 8(7ZA)-(7ZB), new reg 8ZA | Data centres | Clauses 4, 5, 13 |
| Reg 1(3)(ea), (3B)-(3E), new regs 14C, 14D | Managed service providers | Clauses 9, 11, 14 |
| Reg 18 | Penalties | Clause 21; Schedule 2 para 11 |

**Not covered here:** regs 2 to 9 (except the data centre changes to reg 8), 13, 14, 14A, 15 to 17, 19 to 25, the [critical supplier](/glossary/critical-supplier) regime (new regs 14H to 14L, inserted by clause 12), large load controllers (Schedule 2 para 1, amended by clause 6), cost recovery (clause 17), information sharing (clause 18), information powers (clause 20), enforcement and appeals (clause 22 and Schedule 1), and Parts 3 and 4 of the Bill, which do not amend the NIS Regulations at all. For those, use the official Keeling schedules listed below with care, because they track earlier prints.

## How to read it

- **Current text** is quoted from legislation.gov.uk's revised version of SI 2018/506, which was up to date to 30 September 2026 with no outstanding effects listed when we checked on 9 November 2026. We removed legislation.gov.uk's square-bracket amendment markers. Where it prints "..." the words were repealed by an earlier amending instrument.
- **Amended text** is quoted from HL Bill 62. In amended passages, **bold** marks words the Bill inserts and ~~struck-through~~ marks words it removes.
- Where the Bill inserts a whole new regulation, we summarise it and quote only the key words. Anything not in quotation marks is our summary, not statutory text.
- Clause numbers are those of HL Bill 62 and will change in the Act. The NIS regulation numbers are more stable, so cite those where you can.

## Is there an official Keeling schedule for HL Bill 62?

No, not as of 9 November 2026. The Bill's [publications list](https://bills.parliament.uk/bills/4035/publications) contains two Government Keeling schedules of the NIS Regulations, both for earlier prints:

- [The Network and Information Systems Regulations 2018 Keeling schedule, 22 January 2026](https://publications.parliament.uk/pa/bills/cbill/59-01/0329/nisr_CSRB_Keeling_Schedule%29_220126.pdf), for the Commons Bill (Bill 329).
- [Keeling text prepared by DSIT for the Bill as introduced to the House of Lords on 17 June 2026](https://bills.parliament.uk/publications/66771/documents/8422) (HL Bill 32).

Neither reflects the Lords amendments made at Committee (HL Bill 49) or at Report (HL Bill 62). This page fills that gap for the provisions listed above. The four Third Reading amendments of 2 November 2026 changed clauses 2, 24, 36 and 42, none of which amends the NIS Regulations, so they do not affect the text below. The Commons has not yet considered the Lords amendments, and the Lords Amendments paper (Bill 175, 3 November 2026) is the document it will work from.

## Regulation 1: interpretation

### "Incident" (clause 15(2))

**Current reg 1(2):**

> "incident" means any event having an actual adverse effect on the security of network and information systems;

**As amended:**

> "incident" means any event having an actual adverse effect on the **operation or** security of network and information systems;

The "actual adverse effect" test stays. Outages and degradation that affect operation would count, not only security compromises.

### "Cloud computing service", "digital service" and "relevant digital service" (clause 7(3) to (5) and (7))

**Current reg 1(2):**

> "cloud computing service" means a digital service that enables access to a scalable and elastic pool of shareable computing resources;

**As amended (substituted by clause 7(3)):**

> "cloud computing service" means a digital service— (a) which enables access to a scalable and elastic pool of shareable computing resources (such as networks, servers, software and storage) where— (i) there is broad remote access to the service, (ii) the service is capable of being provided on demand and on a self-service basis, (iii) the pool of computing resources may be distributed across two or more locations, and (iv) the service is not provided by a person solely for use for the purposes of a business or other activity carried on for that person, and (b) which is not a managed service;

Clause 7(4) omits the definitions of "digital service" and "digital service provider". Clause 7(5) inserts:

> "relevant digital service" means an online marketplace, an online search engine or a cloud computing service;

Clause 7(7) inserts a new reg 1(2A) defining "broad remote access", "scalable", "elastic" and "shareable" for the cloud definition.

### Relevant digital service provider (clause 7(8) and (9))

**Current reg 1(3)(e):**

> a "relevant digital service provider" ("RDSP") is a reference to a person who provides a digital service in the United Kingdom and satisfies the following conditions— (i) the head office for that provider is in the United Kingdom or that provider has nominated a representative who is established in the United Kingdom; (ii) the provider is not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC;

**As amended (substituted by clause 7(8)):**

> a "relevant digital service provider" ("RDSP") is a reference to a person which— (i) provides a relevant digital service in the United Kingdom (whether or not the person is established in the United Kingdom), (ii) is not designated under regulation 14H in relation to the provision of that service, (iii) is not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC, and (iv) either— (aa) is not subject to public authority oversight, or (bb) is subject to public authority oversight but derives more than half of its income from activities of a commercial nature;

Clause 7(9) adds reg 1(3A): a person "does not provide a relevant digital service by virtue of providing a public electronic communications network or a public electronic communications service".

### Managed service and RMSP (clauses 9 and 11)

There is no current equivalent. Clause 9(4) inserts reg 1(3)(ea):

> a "relevant managed service provider" ("RMSP") is a reference to a person which— (i) provides a managed service in the United Kingdom (whether or not the person is established in the United Kingdom), (ii) is not designated under regulation 14H in relation to the provision of that service, (iii) is not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC, and (iv) either— (aa) is not subject to public authority oversight, or (bb) is subject to public authority oversight but derives more than half its income from activities of a commercial nature;

Clause 9(5) inserts reg 1(3B):

> "Managed service" means a service which— (a) is provided by a person ("P") under a contract entered into by P and another person ("the customer") for the provision of ongoing management of information technology systems for the customer (whether in the form of support and maintenance, monitoring, active administration or other activities), and (b) is provided to the customer by means of P, or a person acting on P's behalf, connecting to or otherwise obtaining access to network and information systems relied on by the customer in connection with a business or other activity carried on by the customer.

Reg 1(3C) says it does not matter whether access is "on the customer's premises or remotely". Reg 1(3D) excludes data centre services and public electronic communications networks and services. Clause 11 inserts reg 1(3E), which defines "subject to public authority oversight" as being under the management or control of UK public authorities, or of a board more than half of whose members they appoint.

### Other reg 1 changes (clause 12(2); Schedule 2 para 2)

- Inserted: "critical supplier" means "a person for the time being designated under regulation 14H".
- Inserted: "CSIRT" means "the person designated by regulation 5 (computer security incident response team)", and "SPOC" means "the person designated by regulation 4 (single point of contact)".
- Omitted: the definition of "EU Regulation 2018/151", and reg 1(3)(c) (the reference to "the relevant authorities in a Member State"). Schedule 2 para 17 revokes Commission Implementing Regulation (EU) 2018/151 itself.
- In the definition of "representative", "a digital service provider" becomes "an RDSP" (clause 7(6)) and then "an RDSP or an RMSP" (Schedule 2 para 2).

## Security duties

### Regulation 10: operators of essential services (Schedule 2 para 8)

The only change to reg 10 is in paragraph (2). Paragraphs (1), (3) and (4) are unchanged.

**Reg 10(2) as amended:**

> An OES must take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting the security of the network and information systems used for the provision of an essential service~~, with a view to ensuring the continuity of those services~~.

The duty in reg 10(1) to "take appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which their essential service relies" is unchanged.

### Regulation 12: relevant digital service providers (clause 8; clause 15(4))

**Reg 12(2) as amended:**

> The measures taken by a RDSP under paragraph (1) must— (a) (having regard to the state of the art) ensure a level of security of network and information systems appropriate to the risk posed; (b) prevent and minimise the impact of incidents affecting ~~their network and information systems with a view to ensuring the continuity of those services~~ **the security of network and information systems referred to in paragraph (1)**; ~~and (c) take into account the following elements as specified in Article 2 of EU Regulation 2018/151— (i) the security of systems and facilities; (ii) incident handling; (iii) business continuity management; (iv) monitoring auditing and testing; and (v) compliance with international standards.~~

Clause 8(3) inserts reg 12(2A): "An RDSP must have regard to any relevant guidance issued by the Information Commission when carrying out the duties imposed on it by paragraph (1)."

Clause 15(4) omits reg 12(3) to (9) and (11) to (16), the current RDSP incident-reporting rules, because new regs 12A and 12B replace them. The heading of reg 12 gains the words ": duties to manage risks to network and information systems".

### New regulation 14B: relevant managed service providers (clause 10)

There is no current equivalent. Clause 10 inserts a new Part 4A, starting with reg 14B:

> (1) An RMSP must identify and take appropriate and proportionate measures to manage the risks posed to the security of network and information systems on which it relies for the purpose of providing managed services within the United Kingdom.
>
> (2) The measures taken by an RMSP under paragraph (1) must— (a) (having regard to the state of the art) ensure a level of security of network and information systems appropriate to the risk posed, and (b) prevent and minimise the impact of incidents affecting the security of network and information systems referred to in paragraph (1).
>
> (3) An RMSP must have regard to any relevant guidance issued by the Information Commission when carrying out the duties imposed on it by paragraph (1).

## Incident reporting

### Regulation 11: operators of essential services (clause 15(3))

Clause 15(3) substitutes the whole of reg 11.

**Current reg 11(1) to (3), key words:**

> (1) An OES must notify the designated competent authority for the OES in writing about any incident which has a significant impact on the continuity of the essential service which that OES provides ("a network and information systems ("NIS") incident").
>
> (2) In order to determine the significance of the impact of an incident an OES must have regard to the following factors— (a) the number of users affected by the disruption of the essential service; (b) the duration of the incident; and (c) the geographical area affected by the incident.
>
> (3) ... (b) be provided to the competent authority— (i) without undue delay and in any event no later than 72 hours after the operator is aware that a NIS incident has occurred ...

**New reg 11, key words:**

> (2) If the OES is aware that an OES incident has occurred or is occurring, it must give the designated competent authority for the OES— (a) an initial notification containing— (i) the OES's name and the essential service to which the incident relates, and (ii) brief details of the incident, and (b) a full notification containing the information listed in paragraph (5) in relation to the incident, so far as known to the OES.
>
> (3) For the purposes of this regulation, an incident is an "OES incident" if— (a) the incident has affected or is affecting the operation or security of the network and information systems relied on to provide the essential service provided by the OES, and (b) the impact of the incident in the United Kingdom or any part of it has been, is or is likely to be significant having regard to the factors listed in paragraph (4).
>
> (6) The notifications required by paragraph (2) must be given— (a) in the case of an initial notification, before the end of the period of 24 hours beginning with the time at which the OES is first aware that an OES incident has occurred or is occurring; (b) in the case of a full notification, before the end of the period of 72 hours beginning with that time.
>
> (8) An OES must send a copy of a notification under paragraph (2) to the CSIRT at the same time as sending the notification to the designated competent authority for the OES.

In summary, the changes to reg 11 are:

| Point | Current reg 11 | New reg 11 (HL Bill 62) |
|---|---|---|
| Trigger | "significant impact on the continuity of the essential service" | Affects "the operation or security" of the systems, with UK impact that "has been, is or is likely to be significant" |
| Significance factors | Users, duration, geographical area (reg 11(2)) | Seven factors in reg 11(4), adding disruption, data confidentiality, authenticity, integrity or availability, impact on users' systems, and impact on "the economy or the day-to-day functioning of society" |
| Deadline | "without undue delay and in any event no later than 72 hours" | Initial notification within 24 hours, full notification within 72 hours, both counted from first awareness |
| CSIRT | The competent authority shares with the CSIRT | The OES copies the CSIRT "at the same time" |
| Content | Reg 11(3)(a) list | Reg 11(5) list, adding details of any separate incident at another regulated person that caused it |

Reg 11(1) of the new text excludes data centre services, which have their own reg 11A. The regulator and CSIRT functions in current reg 11(5) to (11), covering feedback, informing the public and annual reports, move to new reg 11B, which also lets the regulator direct the OES to inform the public (reg 11B(6)(b)).

### New regulation 11A: data centres (clause 15(3))

Data centre operators give the same 24-hour initial and 72-hour full notifications to their designated competent authority (Ofcom, under clause 4(2)), with a copy to the CSIRT. The test differs. A "data centre incident" is:

> an incident which has had, is having or is likely to have— (a) a significant impact on the operation or security of the network and information systems relied on to provide the data centre service provided by the OES in the United Kingdom, or (b) a significant impact, by virtue of its effect on network and information systems falling within paragraph (4), on the operation or security of the data centre service provided by the OES in the United Kingdom.

Under reg 11A(4), the systems in limb (b) include "a network and information system of a customer of the data centre service".

### Regulation 12(3) to (9) replaced by new regulations 12A and 12B: RDSPs (clause 15(4) and (5))

**Current reg 12(3) and 12(6)(a):**

> (3) A RDSP must notify the Information Commission in writing about any incident having a substantial impact on the provision of any of the digital services mentioned in paragraph (1) that it provides.
>
> (6) The notification under paragraph (3) must— (a) be made without undue delay and in any event no later than 72 hours after the RDSP is first aware that an incident has occurred ...

**New reg 12A, key words:** an "RDSP incident" is one that "has affected or is affecting the operation or security of the network and information systems relied on to provide the relevant digital service" with UK impact that "has been, is or is likely to be significant" against seven factors, the same seven as for OES. The RDSP gives the Information Commission an initial notification "before the end of the period of 24 hours beginning with the time at which the RDSP is first aware" and a full notification "before the end of the period of 72 hours beginning with that time", copied to the CSIRT "at the same time" (regs 12A(5) and (7)).

The "substantial impact" test and the EU Regulation 2018/151 parameters in current reg 12(7) go. New reg 12B carries over the Information Commission's and CSIRT's functions from current reg 12(8) and (11) to (16).

### New regulations 14E and 14F: RMSPs (clause 15(7))

These mirror regs 12A and 12B for managed service providers. An RMSP notifies the Information Commission within 24 hours (initial) and 72 hours (full) of first awareness of an "RMSP incident", with a copy to the CSIRT.

### New regulations 11C, 12C and 14G: notifying customers (clause 16)

There is no current equivalent. Data centre operators (reg 11C), RDSPs (reg 12C) and RMSPs (reg 14G) must act after giving the full notification. For example, reg 12C(1) provides:

> After an RDSP has given a full notification under regulation 12A(1)(b), the RDSP must, as soon as reasonably practicable— (a) take reasonable steps to establish which of its customers in the United Kingdom are likely to be adversely affected by the incident to which the notification relates, and (b) after those steps have been taken, notify those customers of the incident.

The notice must "provide details of the nature of the incident" and "explain why" the provider considers the customer likely to be adversely affected. The provider must then give "such updates about the incident and its impact as the [provider] considers necessary". OES other than data centres have no customer-notification duty in HL Bill 62.

## Data centres

### NIS Regulations Schedule 2, new paragraph 11: thresholds (clause 4(3))

Clause 4 adds a "data infrastructure" subsector to Schedule 1, with "The Office of Communications" as the designated competent authority, and a new paragraph 11 to Schedule 2. Its thresholds are:

> (2) For the essential service of the provision of a data centre service in the United Kingdom, otherwise than on an enterprise basis, the threshold requirement is that the rated IT load of the data centre is equal to or greater than 1 megawatt.
>
> (3) For the essential service of the provision of a data centre service in the United Kingdom on an enterprise basis, the threshold requirement is that the rated IT load of the data centre is equal to or greater than 10 megawatts.

A service is on an "enterprise basis" if the data centre is owned or managed in connection with the person's own undertaking and "the sole purpose of the data centre is to provide information technology services for that undertaking" (para 11(7)). "Rated IT load" is "the maximum electrical power available for the operation of relevant IT equipment housed in the data centre" (para 11(8)(b)).

### Regulation 8: Crown data centres (clause 5)

New reg 8(7ZA) applies the OES designation rules to Crown data centre services. New reg 8(7ZB) excludes services provided by the Security Service, the Secret Intelligence Service or GCHQ, and commercial services provided on behalf of the Government for information classified "secret" or "top secret".

### New regulation 8ZA: registration information (clause 13)

A data centre OES must, "before the end of the relevant 3-month period", give its designated competent authority its name, proper address, directors' or partners' names and "up-to-date contact details (including email addresses and telephone numbers)". The period runs from the first day it is deemed designated, or from service of a designation notice. It must report changes within 7 days.

## Managed service providers

Beyond the definitions in reg 1 and the duties in reg 14B above:

- **Registration, new reg 14C (clause 14(9)).** The Information Commission must keep a register of RMSPs. Each RMSP must submit its name, proper address, directors or partners and contact details "before the registration date". For an RMSP in scope on the day clause 14 comes into force, that date is the end of 3 months beginning with that day. Changes must be notified within 7 days. The Commission must send the register to GCHQ within 4 months of clause 14 coming into force, and then annually.
- **UK representative, new reg 14D.** An RMSP whose principal office is outside the UK must "nominate in writing a representative in the United Kingdom" within the same 3-month window.
- **Regulator.** Clause 9(7) and (8) amend reg 3 so that the Information Commission is the competent authority for RMSPs as well as RDSPs.
- **Incidents and customers.** See regs 14E, 14F and 14G above.

## Regulation 18: penalties (clause 21)

Clause 21(7) substitutes paragraphs (5) to (7) of reg 18 with new paragraphs (5) to (11).

**Current reg 18(5) and (6):**

> (5) The sum of any penalty imposed under this regulation must be an amount that— (a) the competent authority or Information Commission determines is appropriate and proportionate to the failure in respect of which it is imposed; and (b) is in accordance with paragraph (6).
>
> (6) The amount ... must— (a) not exceed £1,000,000 for any contravention which the NIS enforcement authority determines was not a material contravention; (b) ... (c) not exceed £8,500,000 for a material contravention which the NIS enforcement authority determines does not meet the criteria set out in sub-paragraph (d); and (d) not exceed £17,000,000 for a material contravention which the NIS enforcement authority determines has or could have created a significant risk to, or significant impact on, or in relation to, the service provision by the OES or RDSP.

Current reg 18(7) defines "a material contravention" by reference to failures under reg 17(1) and (2).

**New reg 18(5) to (9), key words:**

> (5) A penalty imposed under this regulation— (a) must be of an amount which the designated competent authority or the Information Commission (as the case may be) determines is appropriate and proportionate in the circumstances, including having regard to the matters mentioned in paragraph (6); (b) must not exceed the maximum amount applicable to the failure in respect of which the penalty is imposed.
>
> (6) The matters referred to in paragraph (5)(a) are— (a) the impact of the failure in respect of which the penalty is imposed, (b) any steps taken by the person on which the penalty is imposed to remedy the failure or mitigate its impact, and (c) the person's previous compliance or non-compliance with requirements imposed under or by virtue of these Regulations or regulations under section 29(1) of the Cyber Security and Resilience (Network and Information Systems) Act 2026.
>
> (8) The "standard maximum amount" is— (a) where the person is an undertaking, the greater of— (i) £10,000,000, and (ii) 2% of the turnover of the undertaking (both inside and outside the United Kingdom); (b) in any other case, £10,000,000.
>
> (9) The "higher maximum amount" is— (a) where the person is an undertaking, the greater of— (i) £17,000,000, and (ii) 4% of the turnover of the undertaking (both inside and outside the United Kingdom); (b) in any other case, £17,000,000.

| Point | Current reg 18 | New reg 18 (HL Bill 62) |
|---|---|---|
| Tiers | £1m (not material), £8.5m (material), £17m (material, significant risk or impact) | Standard maximum (reg 18(8)) and higher maximum (reg 18(9)) |
| Turnover cap | None | Greater of £10m and 2%, or greater of £17m and 4%, of worldwide turnover for undertakings |
| Which failures | Set by the "material contravention" test | Listed by duty. The higher maximum (reg 18(11)) covers security duties, failure to notify incidents or meet the 24 and 72-hour rules, customer-notification duties, directions, information notices and enforcement notices. The standard maximum (reg 18(10)) covers duties such as registration under reg 8(2), 8ZA and 14C, copying the CSIRT, customer updates and representatives |
| Factors | "appropriate and proportionate" | "appropriate and proportionate", having regard to impact, remedial steps and compliance history |
| Daily penalties | None | None. Clause 21 does not add any |

Clause 21 also inserts reg 18(2A) (penalty notices to RMSPs) and reg 18(2B) (penalties for breaching an information notice under reg 15 or an enforcement notice). It replaces reg 18(3A) and (3B) with a single procedure for any "person", and changes "OES or RDSP" to "person" in reg 18(3C) to (3E). Paragraph 11 of the Bill's Schedule 2 corrects reg 18(2) by changing "regulation (3A)" to "regulation 17(3A)".

New reg 18(6)(c) names the "Cyber Security and Resilience (Network and Information Systems) Act 2026". If Royal Assent comes in 2027, expect the year to change.

## When would these amendments take effect?

None of them applies on Royal Assent. Under clause 69(3) of HL Bill 62, all of Part 2 (clauses 3 to 23, which make every change on this page) comes into force "on such day as the Secretary of State may appoint by regulations", and different days can be set for different purposes. The only Part 2 exceptions are clause 18(3) and (4) and Schedule 2 paragraphs 3, 4 and 15, which commence two months after Royal Assent under clause 69(2), and none of them changes the provisions on this page. Until then the current text above remains the law. See [when the Bill comes into force](/guides/when-does-the-bill-come-into-force) and [is the Cyber Security and Resilience Act law yet?](/guides/cyber-security-and-resilience-act).

## Sources

- [HL Bill 62, as amended on Report, 26 October 2026](https://bills.parliament.uk/publications/68323/documents/8980): clauses 4 to 16, 21 and 69, and Schedule 2
- [The Network and Information Systems Regulations 2018 (SI 2018/506), legislation.gov.uk](https://www.legislation.gov.uk/uksi/2018/506/contents): [reg 1](https://www.legislation.gov.uk/uksi/2018/506/regulation/1), [reg 10](https://www.legislation.gov.uk/uksi/2018/506/regulation/10), [reg 11](https://www.legislation.gov.uk/uksi/2018/506/regulation/11), [reg 12](https://www.legislation.gov.uk/uksi/2018/506/regulation/12), [reg 18](https://www.legislation.gov.uk/uksi/2018/506/regulation/18), revised text checked 9 November 2026
- [Bill publications, UK Parliament](https://bills.parliament.uk/bills/4035/publications), including the Keeling schedules of 22 January 2026 and 17 June 2026
- [HL Bill 62–I, marshalled list for Third Reading, 30 October 2026](https://bills.parliament.uk/publications/68463/documents/9018)

## Frequently asked questions

### Is there an official Keeling schedule for the Cyber Security and Resilience Bill?

Yes, but not for the current text. The Bill's publications list on the UK Parliament website includes Government Keeling schedules of the NIS Regulations 2018 dated 22 January 2026 (Bill 329) and 17 June 2026 (HL Bill 32, the Bill as introduced to the Lords). As of 9 November 2026 none had been published for HL Bill 62, so neither reflects the Lords amendments.

### What is a Keeling schedule?

A Keeling schedule shows how existing legislation would read once a Bill's amendments are made, with the inserted and removed words marked. The Government publishes them as background documents. They are not law and have no legal effect, and nor does this page.

### Which NIS regulations does HL Bill 62 change most?

Clause 15 substitutes reg 11 and inserts new reporting regs 11A, 11B, 12A, 12B, 14E and 14F. Clause 21 replaces the penalty amounts in reg 18. Clauses 7 and 9 rewrite the reg 1 definitions of cloud computing service, RDSP and the new RMSP. Clause 10 inserts reg 14B, a security duty for managed service providers.

### Does the amended NIS text apply now?

No. The current NIS Regulations 2018 still apply. The Bill has not received Royal Assent, and under clause 69(3) of HL Bill 62 the Part 2 amendments shown here commence only on days the Secretary of State appoints by regulations. Different days can be set for different duties.

### Could the amended text still change?

Yes. The Commons has not yet considered the Lords amendments, and further changes are possible if the Houses disagree. Clause numbers will also be renumbered as sections in the Act. Check the final Act and the revised text on legislation.gov.uk before relying on any wording.