Health regulators and the Cyber Security and Resilience Bill
The health regulator under the Cyber Security and Resilience Bill (CSRB) depends on the nation: the Health Secretary in England, Welsh Ministers in Wales, Scottish Ministers in Scotland and the Department of Finance in Northern Ireland. NHS England is not named as a competent authority in Schedule 1.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Who regulates health care
From Schedule 1 of the NIS Regulations 2018. The Cyber Security and Resilience Bill (CSRB) does not alter this table in the text we reviewed.
| Nation | Designated competent authority |
|---|---|
| England | Secretary of State for Health |
| Wales | Welsh Ministers |
| Scotland | Scottish Ministers |
| Northern Ireland | Department of Finance |
NHS England is often assumed to be the regulator, but Schedule 1 doesn't name it. It may still set requirements or support organisations in other ways, so don't treat this table as a complete map of NHS cyber security.
Who is in scope
Health has no numeric threshold. Schedule 2 names the bodies:
| Nation | Named bodies |
|---|---|
| England | NHS Trusts and NHS Foundation Trusts |
| Wales | Local Health Boards and NHS Trusts |
| Scotland | The Common Services Agency, Health Boards and Special Health Boards |
| Northern Ireland | Health and Social Care Trusts |
Other organisations, such as private providers and IT suppliers, need to look at other routes, such as managed services, cloud services or critical supplier designation.
What is published, and what isn't
| Item | Status when checked |
|---|---|
| DHSC NIS guide for the health sector in England | Published |
| Update reflecting the Bill's reporting duties | Not found |
| Notification form under the Bill | Not found |
| Charging scheme under the Bill | Not found |
Checked 2 November 2026. Regulators may publish more once the Bill passes, so check their own pages. The DHSC guide points organisations in other sectors to their own regulators. We haven't assessed here how it interacts with NHS assurance tools. See our NHS cyber standards guide.
What the Bill changes for health bodies
Reporting. Trusts and similar bodies would make an initial notification within 24 hours and a full notification within 72 hours of first awareness, with a copy to the CSIRT. An incident plan should say who decides out of hours, and how clinical teams raise a concern.
Suppliers. The critical supplier power responds directly to dependencies like the 2024 Synnovis attack. NHS England's London figures put disruption at 1,134 planned operations and 2,194 outpatient appointments postponed. A trust should know which suppliers it could not replace quickly.
Regulated suppliers will notify you. A regulated managed or cloud service provider must notify affected UK customers after its full notification. Check the notice reaches someone who can act on it.
Charges. Regulators may charge regulated organisations through a scheme. How that would apply to publicly funded bodies isn't clear from what we've read.
What to do
- Confirm which authority covers you, especially across borders.
- Update incident plans for the new timelines.
- Rank suppliers by clinical dependency.
- Align contract clauses with supplier notification duties.
Sources
Frequently asked questions
In England, the Secretary of State for Health. NHS England is not named in Schedule 1 as a competent authority, although it can play other roles in NHS cyber security.
Schedule 2 names NHS Trusts and Foundation Trusts in England; Local Health Boards and NHS Trusts in Wales; the Common Services Agency, Health Boards and Special Health Boards in Scotland; and Health and Social Care Trusts in Northern Ireland.
Schedule 2 lists NHS bodies rather than private hospitals. Schedule 1 describes the subsector as health care settings including private clinics, and regulators can designate in some circumstances. Private providers could also be caught as suppliers. See our private healthcare page.
It could be considered if it meets the statutory tests. The government uses the 2024 Synnovis attack on an NHS pathology provider as a case study, without saying Synnovis would be designated.