The Information Commission and the Cyber Security and Resilience Bill
The Information Commission would regulate relevant digital service providers and relevant managed service providers under the Cyber Security and Resilience Bill (CSRB). It would hold the registers, receive incident notifications and enforce the duties. It has an existing NIS guide for digital services, but we found no RMSP guidance yet.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The Commission's role
Under the NIS Regulations 2018 the Information Commissioner regulates digital service providers. Section 9 of the Cyber Security and Resilience Bill (CSRB) extends that role to managed service providers, using the name "the Information Commission". Some government pages still use "ICO".
Who it would regulate
| Category | Covers | Key exclusions |
|---|---|---|
| RDSP | Cloud computing services, online marketplaces and online search engines | Micro and small enterprises; public authority oversight, unless over half of income is commercial |
| RMSP | Ongoing IT management with access to customer systems | Same exclusions; data centre and public electronic communications services |
It can also designate a direct supplier of an RDSP or RMSP as a critical supplier, if the statutory tests are met.
What it would do
- Register: maintain registers of RDSPs and RMSPs and send copies to GCHQ.
- Receive notifications: take 24-hour and 72-hour notifications. Copies go to the CSIRT.
- Publish or direct: with the CSIRT, it can inform the public or direct a provider to do so, where public awareness is necessary or in the public interest, after consultation.
- Enforce: require information, inspect, serve notices and impose penalties. Serious failures carry a maximum of the greater of £17 million and 4% of turnover, and administrative failures the greater of £10 million and 2%.
What is published, and what isn't
| Item | Status when checked |
|---|---|
| Guide to NIS for digital services | Published, written for the current regime |
| Security guidance for RMSPs | Not found |
| Registration process for RMSPs | Not found |
| Notification form | Not found |
| Charging scheme | Not found |
Checked 2 November 2026. Regulators may publish more once the Bill passes, so check their own pages. RMSPs must have regard to relevant Commission guidance when carrying out their security duties, so that guidance will matter once published.
How registration would work
An RMSP must give the Commission its name, proper address, directors or partners, and up-to-date contact details, including email and telephone. The deadline is three months after the registration section starts if you already meet the conditions, otherwise three months after first meeting them. An RDSP gives similar details, along with which relevant digital services it provides.
A provider with its principal office outside the UK must also nominate a UK representative in writing, and provide the representative's contact details. The Commission must send a copy of each register to GCHQ, within four months of the section starting and annually after that.
Two practical cautions
Don't merge your NIS and data protection processes without thought. A single incident may require a NIS notification and a separate personal data breach notification, on different tests and with different content.
Keep your details current. Registration includes directors' names and contact details. A change must be notified within seven days, and registration failures sit in the standard penalty band.
Sources
Frequently asked questions
The Information Commission regulates relevant managed service providers. Some government material still refers to the ICO, the Commission’s predecessor name in common use.
Yes. NIS duties and UK GDPR duties are separate regimes with different tests, although the same regulator oversees both for these organisations.
Three months from the day the relevant section starts if you already meet the conditions, otherwise three months from first meeting them. Changes must be notified within seven days.
We found no RMSP guidance when we checked in November 2026. The Bill requires regard to its guidance, so check for updates before finalising your plans.