NIS Regulations 2018 vs the Cyber Security and Resilience Bill
The Cyber Security and Resilience Bill (CSRB) amends the NIS Regulations 2018 instead of replacing them. It adds managed service providers, data centres and critical suppliers, shortens incident reporting to 24 and 72 hours, and raises fines to as much as 4% of worldwide turnover.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Report Stage update: VinciWorks reports that Government amendments on 26 October 2026 narrowed the incident definition to incidents that have actually adversely affected systems, and removed mandatory near-miss reporting for data centre operators. We could not check this against the amended Bill, so the wording below reflects HL Bill 32 and may be out of date. See what Parliament changed.
The short version
The Cyber Security and Resilience Bill (CSRB) does not start again. Part 2 amends the Network and Information Systems Regulations 2018, so most of the existing regime stays in place with a wider scope, faster reporting and stronger enforcement.
Until the relevant parts commence, the 2018 rules remain the law. Royal Assent alone will not switch on the main duties. See when the Bill comes into force.
What changes at a glance
| Area | NIS Regulations 2018 today | Under the Bill |
|---|---|---|
| Essential services | Energy, transport, health, drinking water and digital infrastructure, above thresholds | The same, plus data centres and large load controllers |
| Digital services | Online marketplaces, search engines and cloud services | The same, with new definitions, including a rewritten cloud definition |
| Managed services | Not a regulated category | New category of relevant managed service providers (RMSPs) |
| Suppliers | No direct designation | Regulators can designate critical suppliers |
| What counts as an incident | An actual adverse effect on the security of systems | Having, or capable of having, an adverse effect on operation or security |
| OES reporting trigger | Significant effect on continuity of the service | Effect on operation or security, with significant or likely significant UK impact |
| Reporting deadline | OES: without undue delay and within 72 hours | 24-hour initial notification and 72-hour full notification |
| Who receives reports | The competent authority | The regulator, with a copy to the CSIRT |
| Customer notices | No general duty in this form | Data centres, RDSPs and RMSPs must notify affected UK customers |
| Fines | Bands of £1m, £8.5m and £17m | Two bands: greater of £10m and 2%, or greater of £17m and 4% of turnover |
| Regulator costs | Limited cost recovery | Broader charging schemes |
| Updating the rules | Through amending regulations | Part 3 gives ministers wider powers to set requirements |
The biggest practical shifts
Reporting has a shorter clock and a wider trigger
Today an operator of essential services (OES) reports incidents that significantly affect continuity, judged on users, duration and geographic area. Under the Bill, the trigger reaches incidents affecting the operation or security of systems, and the list of factors expands to include data compromise.
The clock also changes. Both the 24-hour and 72-hour periods run from first awareness. The significant incident guide covers the test in detail.
Fines scale with turnover
The 2018 Regulations cap penalties at £17 million. The Bill replaces the three bands with two, and adds a percentage of worldwide turnover for undertakings. For a large group, the percentage can far exceed the fixed sum.
Which band applies depends on the failure. Security duties and incident notification sit in the higher band for most categories. Registration and some administrative failures sit in the standard band.
Organisations outside the old scope come in
MSPs, large data centres, load controllers and designated suppliers are the new groups. If you are one of them, you are building these processes from scratch rather than adjusting an existing NIS programme.
What stays the same
Several things carry over, which matters if you are already regulated:
- The regulator model. Sector regulators stay, with the Information Commission for digital services. Ofcom takes on data centres, as well as its digital infrastructure role.
- The core security duty. Regulated organisations must still take appropriate and proportionate measures to manage risk.
- Thresholds. Existing Schedule 2 thresholds continue unless changed.
- Inspection and enforcement structure. Information notices, inspections, enforcement notices and penalties remain, with changes.
- The appeal route. Appeals still go to the First-tier Tribunal.
Banks remain outside Schedule 2. Neither the 2018 Regulations nor the Bill's text as brought from the Commons includes a banking subsector.
What to do if you are already an OES or RDSP
- Rewrite your incident procedure. Add the 24-hour step, the CSIRT copy and the wider trigger.
- Review your reporting criteria. Add the new factors, and record how you decide what is significant.
- Update your risk register. Reflect the new maximum fines using your actual worldwide turnover.
- Check your supplier list. Identify suppliers a regulator might consider critical.
- For RDSPs, check the definitions again. The cloud computing definition has been rewritten, and the customer notification duty is new.
- Budget for charges. Regulators will be able to recover more of their costs. See cost recovery.
What to do if you are new to the regime
Start by confirming whether you are in scope, using OES vs RDSP vs RMSP. Then follow the compliance guide. MSPs should use the MSP compliance checklist.
Sources
Frequently asked questions
No. Part 2 of the Bill amends the 2018 Regulations. Part 3 also gives ministers powers to update the regime through further regulations.
Yes. They continue to apply until the relevant changes commence, and Royal Assent alone will not start the main new duties.
Under the 2018 Regulations, an operator of essential services must notify without undue delay and no later than 72 hours after becoming aware of a qualifying incident.
The current bands in the 2018 Regulations are up to £1 million, £8.5 million and £17 million, depending on the contravention. The Bill replaces these with two turnover-linked bands.