Transport regulators and the Cyber Security and Resilience Bill
Transport regulation under the Cyber Security and Resilience Bill (CSRB) stays with the bodies named in the NIS Regulations 2018. The Transport Secretary leads, jointly with the Civil Aviation Authority for air. Scottish Ministers cover road transport in Scotland, and the Department of Finance covers road and rail in Northern Ireland.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Who regulates each mode
From Schedule 1 of the NIS Regulations 2018. The Cyber Security and Resilience Bill (CSRB) does not alter this table in the text we reviewed.
| Mode | Regulator |
|---|---|
| Air | Transport Secretary and Civil Aviation Authority, jointly (UK) |
| Water | Transport Secretary (UK) |
| Rail | Transport Secretary (England, Wales, Scotland); Department of Finance (Northern Ireland) |
| Road | Transport Secretary (England, Wales); Scottish Ministers; Department of Finance (Northern Ireland) |
Main thresholds
| Service | Threshold |
|---|---|
| Aerodrome | More than 10 million annual terminal passengers |
| Air traffic services | En-route licence holders, or providers at airports above 10 million passengers |
| Air carrier | Over 30% of passengers at a qualifying airport and over 10 million total at UK airports |
| Shipping | Over 5 million tonnes of freight and over 30% at a qualifying port, or over 30% of passengers at a port above 10 million |
| Port and harbour | Ports above 10 million passengers, or meeting the freight share tests |
| Mainline rail | Operators of mainline assets in Great Britain, with listed exclusions |
| Metros and light rail | Over 50 million annual passenger journeys |
| Road authority | Roads with over 50 billion total vehicle miles a year |
These are summaries, so check Schedule 2 for the precise wording.
What is published, and what isn't
| Item | Status when checked |
|---|---|
| DfT NIS implementation guidance | Published; the version we found is 1.1, December 2018 |
| Update reflecting the Bill | Not found |
| Notification form under the Bill | Not found |
| Charging scheme under the Bill | Not found |
Checked 2 November 2026. Regulators may publish more once the Bill passes, so check their own pages. Section 19 of the Bill requires guidance on measures and incident duties, so transport guidance is likely to need updating.
What the Bill changes for transport operators
- Reporting: initial notification within 24 hours, and full notification within 72 hours, each from first awareness. Each is copied to the CSIRT.
- Suppliers: a regulator can designate a direct supplier as a critical supplier. Signalling, ticketing, airport systems and similar suppliers may want to consider this, depending on the tests.
- Costs: regulators can charge through a scheme, and existing operators may start paying.
- Establishment: essential service operators can be caught whether or not established in the UK.
Working across modes and borders
A business running several modes might answer to more than one regulator. Bus or road authorities should check the Scottish and Northern Ireland positions. A group with Northern Ireland rail operations has a different regulator and threshold from a similar operation in Great Britain.
What to do
- Confirm passenger or freight figures against thresholds.
- Identify which systems support the essential service, including operational technology.
- Review supplier dependencies for hard-to-replace services.
- Practise joint decision-making with safety and operations teams, as the incident clock doesn't pause for shift handovers.
Sources
Frequently asked questions
The Secretary of State for Transport and the Civil Aviation Authority, acting jointly across the UK.
The aerodrome threshold is more than 10 million terminal passengers a year. Smaller airports are unlikely to meet the deemed threshold, although regulators can designate in some cases.
Mainline railway operators in Great Britain, with listed exclusions, high speed rail, metros and light rail with over 50 million annual passenger journeys, and Channel Tunnel services. Northern Ireland has its own rule.
The version we found is 1.1 from December 2018, so it predates the Bill. Check GOV.UK for updates.