Cyber Security and Resilience Bill: secondary legislation tracker
Much of the detail in the Cyber Security and Resilience Bill (CSRB) is left to later regulations, codes and regulator guidance. As of 2 November 2026 we have not found any of these in final form, because their powers cannot be used until the Bill has passed.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Why this matters
The Cyber Security and Resilience Bill (CSRB) sets the framework, but a lot of what you will actually have to do will be set later. Ministers have told Parliament that detailed requirements and thresholds will follow consultation.
Last checked: 2 November 2026. This tracker reflects section numbers in HL Bill 32, which may change. "Not found" means we did not find a final document, not that no work is under way.
Tracker
| Item | Power | Who decides | What it could cover | Status |
|---|---|---|---|---|
| Commencement regulations | s.60(3) | Secretary of State | Start dates for Part 2 and other provisions | Cannot be made before the Act passes |
| Transitional provisions | s.60(7) | Secretary of State | How the move to the new regime works | Not found |
| Security and resilience regulations | s.29(1) | Secretary of State | Requirements on regulated persons, including security measures | Not found |
| Essential activities and regulated persons | ss.24 and 30 | Secretary of State | Adding activities and describing who is regulated | Not found |
| Regulatory authorities | s.24(6) | Secretary of State | Designating further regulators | Not found |
| Statement of strategic priorities | s.25 | Secretary of State | Priorities for regulators | Not found |
| Code of practice | s.36 | Secretary of State | Measures recommended for compliance, after consultation | Not found |
| Regulator guidance | s.19 | Each regulator | Security measures and incident duties | Not found for the new duties |
| Notification form and manner | regs 11, 11A, 12A and 14E | Each regulator | How to send 24 and 72-hour notices | Not found |
| Charging schemes | s.17, reg 20A | Each regulator | Periodic charges on regulated organisations | Not found |
| Critical supplier requirements | ss.12, 29 and 60(5) | Secretary of State, then regulators | Duties on designated suppliers | Not found |
What each one means for you
Section 29 regulations matter most. They could turn broad duties into more specific requirements, and they can apply to organisations whether or not they are established in the UK.
The code of practice describes recommended measures. Before writing a policy around it, read section 38 in the final Act to see what legal effect it has.
Regulator guidance must cover the security measures and incident duties in the NIS Regulations. For RMSPs, regulation 14B(3) says you must have regard to Information Commission guidance.
Notification form and manner decide how your templates must look. Until regulators publish these, treat any template as a draft.
Charging schemes decide what you pay. The power lets regulators recover costs from those they regulate, but amounts are not in the Bill. See cost recovery.
What you can do before the detail arrives
You do not need the regulations to begin. The duties most likely to be challenging already appear in the Bill's text: registration, risk management, 24-hour and 72-hour reporting, and customer notification. Work on these first, and keep anything that depends on the unknown detail easy to change, such as templates, evidence formats and budget assumptions.
How to keep up
- Watch GOV.UK for DSIT consultations on the Bill.
- Watch your regulator. Ofcom regulates data centres, and the Information Commission regulates RDSPs and RMSPs.
- Respond to consultations if thresholds or reporting detail would affect your business.
- Revisit your plan each time one of the rows above changes.
Sources
Frequently asked questions
Rules made by ministers using powers in an Act, without a new Act of Parliament. Much of this Bill’s detail will arrive this way.
DSIT has said further consultations on implementation will happen. We could not confirm from official sources that one has opened as of 2 November 2026, so check GOV.UK.
Part 2 duties start on dates set by regulations. Requirements on critical suppliers also depend on regulations, because section 12 must start on the same day as the first relevant regulations under section 29(1).
Yes, within limits. Section 29 lets the Secretary of State make regulations on the security and resilience of relevant systems. Peers and Lords committees have raised concerns about the breadth of these powers.