Could the Cyber Security and Resilience Bill be extended to more sectors?
The Cyber Security and Resilience Bill (CSRB) would let the Secretary of State bring new sectors into scope by regulations under clause 24(3), after consultation and with approval from both Houses. No sector has been promised. This guide covers the power, the Lords clause 66 review and the sectors Parliament has asked about.
Last updated · Precursor SecurityStatus checked : the Bill passed the House of Lords on 2 November 2026 and returns to the Commons, which is due to consider the Lords amendments on 24 November 2026. On 4 November 2026 the Commons extended its carry-over, so it lapses if not passed by the end of 29 April 2027. It is not yet law. References are to HL Bill 62 (as amended on Report), so wording and numbering may still change in the final Act. This guide is general information, not legal advice.
Key points
- Clause 24(3) would let ministers add essential activities by regulations; clauses 29 and 30 impose the duties.
- Adding a sector needs consultation and approval by both Houses (clause 43).
- The Lords clause 66 review must consider all CNI sectors, advanced manufacturing, large-scale retail of essential goods other than food, SaaS, elections and more within 12 months.
- The Government opposed clause 66 and instead promised a scope statement within 12 months of Royal Assent.
- Banking and telecoms sit under their own regimes; central government relies on its own standards.
- No new sector, timetable or regulator has been announced.
Could the Bill be extended to more sectors?
Yes, without a new Act. Clause 24(3) of the Cyber Security and Resilience Bill (CSRB) would let the Secretary of State add "essential activities" by regulations, with duties imposed under clauses 29 and 30. Each step needs consultation and approval by both Houses. No sector has been promised, only a scope statement within 12 months of Royal Assent.
The Bill has passed both Houses but is not yet law, and the Commons still has to consider Lords amendments. On 4 November 2026 the Commons extended the carry-over, so the Bill lapses if it is not passed by the end of 29 April 2027. Check the timeline. Clause numbers are from HL Bill 62, the text as amended on Report.
Which sectors are covered today?
The NIS Regulations 2018 cover five essential service sectors and three digital services. The Bill adds four groups by name.
| Covered now (NIS Regulations 2018) | Added by the Bill itself | Not covered |
|---|---|---|
| Energy (electricity, oil, gas) | Data centres, as a new "data infrastructure" subsector (clause 4) | Banking and financial market infrastructure |
| Transport (air, rail, water, road) | Large load controllers, in the electricity subsector (clause 6) | Public electronic communications (telecoms) |
| Health | Relevant managed service providers (clauses 9 and 10) | Central and local government |
| Drinking water | Critical suppliers, by designation (clause 12) | Food, manufacturing and retail |
| Digital infrastructure | Waste water, space, postal, chemicals, research | |
| Online marketplaces, search engines, cloud computing | Education, elections and political parties |
The Government says these rules "do not cover the whole economy" (GOV.UK summary factsheet). Its Impact Assessment puts it more directly: "not all sectors or services, such as retail, are in scope".
Which clause lets the Government add a sector?
Part 3, starting with clause 24. We have checked each step against the HL Bill 62 text.
| Step | What the power does | Clause |
|---|---|---|
| 1. Specify an essential activity | The Secretary of State may specify an activity by regulations, but "only if" its carrying on is essential to the economy of the UK, or of any part of it, or to "the day-to-day functioning of society" | 24(3) and (4) |
| 2. Designate a regulator | The Secretary of State may designate a "regulatory authority" by regulations, which must exercise "functions of a public nature in the United Kingdom" | 24(6) and (7) |
| 3. Impose duties | Regulations may impose requirements on "regulated persons" carrying on an essential activity in the UK, or providing an "activity-critical supply", wherever they are established | 29(1), 30(1) to (3) |
| 4. Set the content | Duties can include specified security action, prohibitions, reporting, information and a UK representative | 30(6) |
| 5. Give regulators teeth | Monitoring, investigation, inspection, entry and search, and penalties with an appeal route | 31 |
| 6. Cap the penalties | No more than the greater of £17 million and 10% of turnover for an undertaking | 33(3) |
| 7. Let regulators charge | Charging schemes for regulators' costs | 35 |
| 8. Consult and get approval | Consultation before specifying an activity, designating a regulator or imposing duties; then a draft laid before and approved by each House (the affirmative procedure) | 43(1), (2) and (5) |
Clause 2(3)(a) summarises the purpose: powers "to specify activities to be regulated and to designate regulatory authorities to carry out that regulation". The services already in the NIS Regulations are treated as essential activities automatically (clause 24(5)(b)), and the existing regulators and the Information Commission count as regulatory authorities (clause 24(8)).
Chapters 1, 3 and 6 of Part 3, which hold all of these powers, would come into force on Royal Assent (clause 69(1)(b)). The Government's futureproofing factsheet confirms these powers are "Day 1" measures.
Our analysis. Specifying an activity under clause 24(3) does nothing on its own. Nobody in a new sector would have a duty until regulations under clause 29 impose one. The power can also reach suppliers: an "activity-critical supply" is any supply of goods or services "without which the carrying on of an essential activity would be at risk of disruption" (clause 29(6)). That is broader than the clause 12 critical supplier designation, which needs a regulator decision for each supplier.
What are the limits on the power?
The Bill and the Government's factsheet set out these limits.
- The essential test. An activity must be essential to the economy or the day-to-day functioning of society, in the UK or any part of it (clause 24(4)).
- Consultation. The Secretary of State must consult "such persons as the Secretary of State considers appropriate" first (clause 43(1)).
- Both Houses must approve. Regulations needing consultation, or amending primary legislation, are draft affirmative (clause 43(5)).
- No criminal offences. The futureproofing factsheet says the power could not "allow for the introduction of criminal offences as part of the sanctions regime; or extend the regulations to aspects that do not concern networks and information systems".
- Penalty ceiling. The clause 33(3) cap applies.
The factsheet also says any such determination is expected to "be based on evidence, such as threat intelligence, impact assessments, and substantial policy development". The Bill itself does not require that, beyond the essential test and consultation. Peers debated how wide these powers are, which we cover in Henry VIII powers explained.
Why does the Government want this power?
Because it cannot currently change the NIS Regulations quickly. The futureproofing factsheet says that "following the UK's departure from the EU, the government no longer has appropriate powers to amend the Network and Information Systems (NIS) Regulations 2018 ... without requiring primary legislation". The 2018 Regulations were made under the European Communities Act 1972, according to the Impact Assessment.
The same factsheet says the two post-implementation reviews "illustrated the need for additional services and activities to be brought into scope", and that the new power would let other entities "be added through secondary legislation ... if sectors need to be bought into scope due to their importance, changes in the threat landscape, or even technical changes in the sectors they operate in".
What does the Lords clause 66 review require?
A review of which sectors should be in scope, within 12 months of Royal Assent and then at least yearly. Peers inserted it on 26 October 2026 as Amendment 163 (Lord Birt), by 202 votes to 155, against the Government. It is clause 66 of HL Bill 62.
| Requirement | Detail | Subsection |
|---|---|---|
| Deadline | Within 12 months of the day the Act is passed | 66(1) |
| Organisations to identify | Categories of organisation "in both the public and private sectors" with a material impact on the economy, society or national defence and security | 66(2)(a) |
| Sectors to consider | Whether further sectors should be specified under clause 24(3), with particular regard to the list below | 66(3)(c) |
| Thresholds | Whether thresholds, "including those which exclude micro and small enterprises, leave significant risks unaddressed" | 66(4)(b) |
| Factors | Impact on the economy and society, supply chain role, whether the activity already has comparable requirements, and proportionality | 66(6) |
| Consultees | The NCSC, the Information Commission, the competent authorities and the AI Security Institute | 66(7) |
| Report | Findings, the activities the Secretary of State intends to bring in with a timetable, and reasons for not bringing in others | 66(8) |
| Follow-up | Within six months of a report recommending an activity, lay draft clause 24(3) regulations or a statement explaining why not | 66(9) |
| Repeat | Further reviews at intervals of no more than 12 months | 66(10) |
The sectors listed in clause 66(3)(c) are:
- All sectors forming part of the UK's critical national infrastructure.
- Digital infrastructure, including cloud services, software-as-a-service and content delivery networks.
- Frontier AI models and systems, and other frontier agentic technologies.
- Democratic processes, including election administration and registered political parties.
- Advanced manufacturing, life sciences and critical transport equipment.
- Sectors of social importance, including education, research organisations and "large-scale retail distribution of essential goods other than food".
Our analysis. Clause 66 does not add any sector. It forces a published answer, sector by sector, on a fixed clock, and a draft SI or a reasoned refusal within six months of each recommendation. Two caveats apply. The Government opposed it, and the Commons may remove it. On the HL Bill 62 text it sits in Part 4, which commences only by regulations under clause 69(3), even though its 12-month deadline runs from Royal Assent.
What has the Government promised instead?
A statement, not a sector. Opposing Amendment 163 at Report, the Minister, Baroness Lloyd of Effra, said:
"I can today commit that, within 12 months of the Bill passing, the Secretary of State will lay a Statement setting out whether future CNI activities should be brought into scope of the NIS regulations."
She said the review "will focus on CNI sectors not currently in scope of the NIS or the Bill, including, for instance, government and the food sector", and that once it is complete "the Government could then consult on which of those sectors could be added" (HL Deb 26 October 2026, c1004). She also pointed to "a comprehensive post-implementation review within three years of Royal Assent". Clause 41 requires a report on the legislation at least every three years.
Our analysis. The commitment is narrower than clause 66. It covers critical national infrastructure only, has no follow-up duty and no repeat cycle, and promises consultation as a possibility ("could"), not a step. If the Commons removes clause 66, this ministerial statement is what remains.
Which sectors have MPs and peers asked to add?
Five come up repeatedly. Each row links to the Hansard debate. Column references are to the official report.
| Sector | Who asked, and where | What they said | Covered by clause 66? |
|---|---|---|---|
| Food | Matt Western, Commons Second Reading, 6 January 2026, c188; Lord Clement-Jones, Lords Report, 26 October 2026, c1003 | Asked the Minister to "consider introducing legislation to cover food production and distribution, manufacturing and other critical sectors" | Through "all sectors forming part of the UK's critical national infrastructure". Food retail is expressly carved out of item (vi). The Minister named food at c1004 |
| Manufacturing | Matt Western, c188; Victoria Collins, c190; Baroness Northover, Lords Second Reading, 14 July 2026, c571 | Collins: "leaving out sectors such as retail and manufacturing would mean that the JLR and M&S cyber-attacks remained out of scope" | "Advanced manufacturing, life sciences, and critical transport equipment" |
| Retail | Chi Onwurah, Commons Second Reading, c193; Lord Taylor of Warwick, Lords Second Reading, c600 | Lord Taylor: "Can the Minister explain why the scope of the Bill cannot be extended ... to include large private retailers, at least those over a certain defined size or turnover?" | "Large-scale retail distribution of essential goods other than food" |
| Banking | Dame Meg Hillier, Commons Second Reading, c175 | "What is the Minister's thinking about how to involve the banking sector in the scope of the Bill?" | Only if part of critical national infrastructure; no specific item |
| Public sector | Victoria Collins, c190; Chi Onwurah, c193 | Onwurah: "Government Departments, local administrations and public bodies, such as the BBC, are also outside the scope of the legislation" | "Public and private sectors" in 66(2)(a); democratic processes in 66(3)(c)(iv). The Minister named government at c1004 |
Debates: Commons Second Reading, 6 January 2026; Lords Second Reading, 14 July 2026; Lords Report, 26 October 2026.
Several speakers compared the UK with the EU. Matt Western noted that NIS2 has "added sectors such as manufacturing, food distribution and waste water" (c188). The EU's NIS2 Directive, (EU) 2022/2555, lists banking, financial market infrastructures, waste water, public administration and space in Annex I, and food, manufacturing, chemicals, postal and courier services, waste management and research in Annex II. NIS2 does not apply in the UK; see does NIS2 apply to UK companies?.
Why are some sectors excluded today?
Different reasons for different sectors. Some are covered elsewhere, and some were never in the UK version of the regime.
| Sector | Why it is outside the Bill | Primary source |
|---|---|---|
| Banking and financial market infrastructure | Left out in 2018 because "equivalent EU legislation applies". Today, firms answer to the FCA, PRA and Bank of England, and the critical third parties regime oversees key suppliers to the sector. The EU's DORA is not UK law | NIS Regulations Explanatory Memorandum, para 4.4; first PIR (2020); Financial Services and Markets Act 2023, s18; Bank of England PS16/24 |
| Telecoms | Covered by the Telecommunications (Security) Act 2021, enforced by Ofcom. The Bill says providing a public electronic communications network or service does not make a person an OES, an RDSP or a managed service provider | Telecommunications (Security) Act 2021; HL Bill 62 clauses 3, 7 and 9 |
| Central government | The Minister said "Government Departments will be held to standards equivalent to those set out in the Bill. That is why the public sector and the Government are not included in the scope of the Bill" | HC Deb 6 January 2026, c175 |
| Local government | Never in the NIS Regulations. Victoria Collins argued that "voluntary schemes are failing local authorities" | HC Deb 6 January 2026, c190 |
| Food, manufacturing and retail | Not sectors in the original EU NIS Directive, which listed energy, transport, banking, financial market infrastructures, health, drinking water and digital infrastructure. The 2018 Regulations were built on that list. NIS2 later added food and manufacturing in the EU | First PIR (2020); NIS Regulations Schedule 2; NIS2 Annex II |
On banking, the Minister told Dame Meg Hillier that "The banking sector is obviously in the regulators' scope for cyber-security" and that such firms "are covered by their own regulations" (HC Deb 6 January 2026, c175). See critical third parties, FCA and PRA cyber requirements and does DORA apply to UK firms?.
On telecoms, see the Telecommunications (Security) Act and the Bill. On the public sector, see local councils and the Government Cyber Action Plan.
Some public bodies are already in scope. NHS trusts in England, for example, are named operators of essential services in Schedule 2 of the NIS Regulations. Clause 5 applies the data centre rules to the Crown, with exclusions for the intelligence agencies and classified services.
Can an out-of-scope company be caught anyway?
Yes, by two routes that need no new sector.
- Critical supplier designation (clause 12). A regulator may designate a supplier to an OES, RDSP or RMSP if disruption to the supplier could disrupt the regulated service and would be likely to have a significant impact on the economy or day-to-day functioning of society. A manufacturer or software firm can be designated in this way. See critical supplier designation notices.
- Another activity in the same group. A retailer that runs a large data centre, or a bank's subsidiary that sells managed IT services, could be in scope for that activity. See OES vs RDSP vs RMSP.
For retailers and manufacturers, see our retail and manufacturing guides.
How quickly could a new sector be added?
No timetable has been published. The Bill only fixes the order of steps.
| Stage | Fixed by | Timing in the text |
|---|---|---|
| Royal Assent | Parliament | Not yet set. The Commons considers the Lords amendments on 24 November 2026 |
| Scope statement (Government commitment) or clause 66 report | Minister at Report; clause 66(1) and (8) | Within 12 months of Royal Assent |
| Draft regulations or a statement of reasons | Clause 66(9), if it survives | Within six months of a report recommending an activity |
| Consultation | Clause 43(1) | No minimum period in the Bill |
| Approval by both Houses | Clause 43(5) | Depends on parliamentary time |
| Duties start | The regulations themselves | The Government says a "business adjustment period will be communicated prior to new or updated duties coming into force" (summary factsheet) |
Our analysis. Even on the fastest reading, a sector named in a first report would face consultation, a draft SI and parliamentary approval before any duty applied, and then an adjustment period. The power is designed to be quicker than a new Act, but not overnight. The Government has also said its first priority is to implement the measures already in the Bill. At Report the Minister said "we should allow time for these changes to be introduced and bed in" (c1004).
Which sectors look most likely?
Our analysis. This is our reading of the record, not a forecast the Government has made.
| Sector | Signal | Our view |
|---|---|---|
| Government | Named by the Minister at Report; "public and private sectors" in clause 66 | Likely to feature in any review. The Government's stated preference is its own non-statutory standards |
| Food | Named by the Minister at Report; raised in both Houses | Likely to be assessed. Clause 66 deliberately leaves food retail out of its retail item |
| Cloud, SaaS and CDNs | Listed in clause 66(3)(c)(ii) | Some cloud services are already RDSPs. Watch for SaaS and CDN definitions |
| Advanced manufacturing | Listed in clause 66; JLR raised repeatedly | Possible. The Minister confirmed JLR would not be in scope of the Bill (HC Deb c175) |
| Large retail | Listed in clause 66 (non-food essential goods); raised by Lord Taylor and others | Uncertain. No Government signal |
| Banking | Asked about in the Commons | Unlikely through this Bill, given the separate financial regime |
| Telecoms | Excluded in the Bill's text | Very unlikely; it has its own Act |
What should we watch?
- Commons consideration of Lords amendments. Whether clause 66 survives or is replaced by the ministerial commitment.
- The 12-month statement or report. Which sectors it names, and whether it gives a timetable.
- Consultations under clause 43. These will be the first concrete sign a sector is coming.
- The first clause 29 regulations. They will show how duties are drafted, which matters for any later sector. Track them on the secondary legislation tracker.
- Regulator designations under clause 24(6). A new sector may need a new regulator.
Sources
- HL Bill 62, as amended on Report: clauses 2 to 7, 9, 12, 24, 29 to 31, 33, 35, 41 to 43, 66 and 69
- UK Parliament: Lords division 3730 on Amendment 163
- Network and Information Systems Regulations 2018, Schedule 1 and Schedule 2
- Explanatory Memorandum to the NIS Regulations 2018 (para 4.4)
- DCMS: Review of the Network and Information Systems Regulations (first post-implementation review), 29 May 2020
- DCMS: Second Post-Implementation Review of the NIS Regulations 2018, 4 July 2022
- DSIT: Cyber Security and Resilience Bill Impact Assessment, 12 November 2025
- GOV.UK factsheet: Futureproofing
- GOV.UK factsheet: Summary of the Bill
- Telecommunications (Security) Act 2021
- Financial Services and Markets Act 2023, section 18 (critical third parties)
- Bank of England PS16/24: Critical third parties to the UK financial sector
- Directive (EU) 2022/2555 (NIS2), Annexes I and II
- Hansard: Commons Second Reading, 6 January 2026 (Dame Meg Hillier and Ian Murray, c175; Matt Western, c188; Victoria Collins, c190; Chi Onwurah, c193), read through the TheyWorkForYou mirror
- Hansard: Lords Second Reading, 14 July 2026 (Baroness Northover, c571; Lord Taylor of Warwick, c600), read through the TheyWorkForYou mirror
- Hansard: Lords Report, 26 October 2026 (Lord Clement-Jones, c1003; Baroness Lloyd of Effra, c1004), read through the TheyWorkForYou mirror
Frequently asked questions
Yes, once the Bill is law. Clause 24(3) lets the Secretary of State specify an essential activity by regulations if it is essential to the economy or the day-to-day functioning of society. Clauses 29 and 30 then let duties be imposed. Consultation is required, and both Houses must approve the draft regulations (clause 43).
Not by the Bill as drafted. The Minister confirmed JLR would not be in scope (HC Deb 6 January 2026, c175). Clause 66, added by the Lords, requires a review within 12 months of Royal Assent that must consider advanced manufacturing and large-scale retail of non-food essential goods, but the Commons may remove it and it adds no sector by itself.
The 2018 Regulations left out banking and financial market infrastructure because equivalent EU legislation applied, according to their Explanatory Memorandum. Financial firms now answer to the FCA, PRA and Bank of England, and key suppliers can be designated under the critical third parties regime in the Financial Services and Markets Act 2023.
At Lords Report on 26 October 2026, the Minister committed that within 12 months of the Bill passing, the Secretary of State will lay a statement on whether further critical national infrastructure activities should be brought into scope, focusing on sectors such as government and food. Consultation on adding sectors could follow.
Yes. A regulator can designate it as a critical supplier under clause 12 if disruption to it could disrupt a regulated service with significant impact. It can also be caught for another activity, such as running a large data centre or selling managed IT services.