Managed Service Providers

MSP Cyber Security and Resilience Bill Compliance Guide

Complete guide to Cyber Security and Resilience Bill compliance for Managed Service Providers. Understand your obligations, registration requirements, and incident reporting duties under HL Bill 32.

Sector Overview

Managed Service Providers (MSPs) deliver critical IT and security services to businesses and public sector organisations. Under the Cyber Security and Resilience Bill (HL Bill 32), MSPs are regulated as "Relevant Managed Service Providers" (RMSPs) for the first time.

High-Value Target: MSPs often have privileged access to client systems, data, and infrastructure - making them a high-value target for cyber attacks. The Bill recognises this risk and brings MSPs into regulatory scope.

What is a Managed Service Provider Under the Cyber Security and Resilience Bill?

According to Part 2, Section 9 of HL Bill 32, a "managed service" is defined as:

"A service which is provided by a person under a contract entered into by that person and another person for the provision of ongoing management of information technology systems for the customer (whether in the form of support and maintenance, monitoring, active administration or other activities), and is provided to the customer by means of the provider, or a person acting on the provider's behalf, connecting to or otherwise obtaining access to network and information systems relied on by the customer."

- HL Bill 32, Part 2, Section 9, Regulation 1(3B)

The Bill clarifies that it doesn't matter whether the connection or access is established on the customer's premises or remotely. Data centre services and public electronic communications networks/services are explicitly excluded from this definition.

Are You a Relevant Managed Service Provider (RMSP)?

Under Part 2, Section 9 of HL Bill 32, you are a Relevant Managed Service Provider (RMSP) if you meet all of these conditions:

You're an RMSP if you:

Provide a managed service in the United Kingdom (whether or not you're established in the UK)
Are not designated as a critical supplier under regulation 14H in relation to that service
Are not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC
Either: (a) are not subject to public authority oversight, OR (b) are subject to public authority oversight but derive more than half your income from commercial activities

Exemptions:

Micro and small enterprises (as defined by Commission Recommendation 2003/361/EC) are exempt from RMSP designation. However, you must monitor if you grow beyond these thresholds.

Security Duties - Regulation 14B

Under Part 2, Section 10 of HL Bill 32, Regulation 14B sets out your security duties:

Regulation 14B Requirements:

You must identify and take appropriate and proportionate measures to manage the risks posed to the security of network and information systems on which you rely for the purpose of providing managed services within the United Kingdom
The measures must (having regard to the state of the art) ensure a level of security of network and information systems appropriate to the risk posed
The measures must prevent and minimise the impact of incidents affecting the security of network and information systems
You must have regard to any relevant guidance issued by the Information Commission

- HL Bill 32, Part 2, Section 10, Regulation 14B

Registration Requirements - Regulation 14C

Under Part 2, Section 14 of HL Bill 32, Regulation 14C requires RMSPs to register with the Information Commission:

Information You Must Provide (within 3 months):

The name of the RMSP
The RMSP's proper address (registered/principal office for companies, principal office for partnerships)
Where the RMSP is a body corporate: the names of the directors
Where the RMSP is a partnership: the names of the partners or persons having control or management of the partnership business
Up-to-date contact details (including email addresses and telephone numbers)

Update Requirements:

You must notify the Information Commission in writing of any change to the information listed above as soon as reasonably practicable, and in any event before the end of the period of 7 days beginning with the day on which the change took effect.

Registration Date:

The registration date is either: (a) where conditions are satisfied on the day section 14 comes into force, the date 3 months after that day; or (b) in any other case, the date 3 months after the day on which you first become an RMSP.

- HL Bill 32, Part 2, Section 14, Regulation 14C

UK Representative Requirements - Regulation 14D

If your principal office is outside the United Kingdom, Part 2, Section 14 requires you to nominate a UK representative:

You must nominate in writing a representative in the United Kingdom
You must notify the Information Commission of the representative's name and contact details (including email address and telephone number)
You must comply within 3 months: (a) if this applies on the day section 14 comes into force, within 3 months of that day; or (b) otherwise, within 3 months of becoming an RMSP to which this regulation applies
You must notify the Information Commission of any change to the representative information as soon as reasonably practicable, and in any event before the end of 7 days beginning with the day the change took effect (for representative changes) or the day you became aware (for contact detail changes)
The Information Commission or GCHQ may contact the representative instead of or in addition to you for the purposes of carrying out their functions

- HL Bill 32, Part 2, Section 14, Regulation 14D

Incident Reporting Requirements - Regulation 14E

Under Part 2, Section 15 of HL Bill 32, Regulation 14E sets out strict incident reporting requirements:

⚠️ Critical Timeline:

24 Hours: Initial notification must be given before the end of 24 hours beginning with the time you first become aware that an RMSP incident has occurred or is occurring

72 Hours: Full detailed notification must be given before the end of 72 hours beginning with that time

What is an RMSP Incident?

An incident is an "RMSP incident" if:

The incident has affected or is affecting the operation or security of the network and information systems relied on to provide the managed service
The impact of the incident in the United Kingdom or any part of it has been, is or is likely to be significant having regard to factors including: extent of disruption, number of users affected, duration, geographical area, data confidentiality/authenticity/integrity/availability compromise, impact on users' systems, and impact on economy or day-to-day functioning of society

Required Information in Full Notification:

The RMSP's name and the managed service to which the incident relates
The time the incident occurred, its duration and whether it is ongoing
Information concerning the nature of the incident
Where the incident was caused by a separate incident affecting another regulated person: details of that separate incident and of the regulated person
Information concerning the impact (including any cross-border impact) which the incident has had, is having or is likely to have
Such other information as the RMSP considers may assist the Information Commission in exercising its functions

Reporting Requirements:

Notifications must be in writing, provided in such form and manner as the Information Commission determines. You must send a copy of the notification to CSIRT (Computer Security Incident Response Team) at the same time as sending it to the Information Commission.

- HL Bill 32, Part 2, Section 15, Regulation 14E

Customer Notification Requirements - Regulation 14G

After giving a full notification under Regulation 14E, Part 2, Section 16 requires you to notify affected customers:

You must, as soon as reasonably practicable, take reasonable steps to establish which of your customers in the United Kingdom are likely to be adversely affected by the incident
After those steps have been taken, you must notify those customers of the incident
When considering whether a customer is likely to be adversely affected, you must take into account: (a) the extent of any actual or likely disruption to the provision of the managed service, (b) whether the confidentiality, authenticity, integrity or availability of any data relating to the customer is likely to be compromised, and (c) any other impact on network and information systems of the customer
A notification must provide details of the nature of the incident and explain why you consider that the customer is likely to be adversely affected by the incident

- HL Bill 32, Part 2, Section 16, Regulation 14G

Penalties for Non-Compliance

Under Part 2, Section 21 of HL Bill 32, Regulation 18 sets out financial penalties:

Higher Maximum Amount (Serious Failures):

For failures including:

Failure to comply with regulation 14B(1) - security duties
Failure to give notification as required by regulation 14E(1) - incident reporting
Failure to comply with regulation 14E(5) and (6) - notification requirements
Failure to comply with a direction under regulation 14F(4)(b) - public disclosure
Failure to comply with regulation 14G(1)(b) and (3) - customer notification

Maximum: the greater of £17,000,000 and 4% of global turnover

Standard Maximum Amount (Administrative Failures):

For failures including:

Failure to comply with regulation 14C(2) or (5) - registration requirements
Failure to comply with regulation 14D - UK representative requirements
Failure to comply with regulation 14E(7) - sending copy to CSIRT

Maximum: the greater of £10,000,000 and 2% of global turnover

Daily Penalties:

For continuing contraventions, daily penalties may apply. The amount of a penalty is determined to be appropriate and proportionate, having regard to the impact of the failure, steps taken to remedy it, and previous compliance history.

- HL Bill 32, Part 2, Section 21, Regulation 18

Information Requests & Inspections

Under Part 2, Section 20 of HL Bill 32, Regulation 15 gives the Information Commission powers to:

Require you to give such information or documents as it reasonably requires for exercising its functions
Require you to obtain or generate information or documents
Require you to collect or retain information that you would not otherwise collect or retain
Send information notices whether or not you're established in the UK
Request information or documents stored within or outside the United Kingdom

⚠️ Important:

Failure to comply with an information notice is a breach that can result in penalties. You may not be required to give privileged communications (legal advice protected by legal professional privilege).

- HL Bill 32, Part 2, Section 20, Regulation 15

Why the Bill Targets Managed Service Providers

MSPs are regulated because they act as force multipliers for cyber risk. A single compromised provider can give an attacker a route into hundreds of client networks at once, which is what made the Kaseya and SolarWinds incidents so damaging. The Bill responds by placing duties directly on the provider rather than relying on contractual flow-down from customers.

The practical consequence is that an MSP is now accountable not only for its own security, but for the aggregate risk it introduces to every customer it serves. That includes vetting its own suppliers: the duty of care flows downwards, so a failure at a sub-processor remains the MSP's problem.

A two-tier market

Because the RMSP standard is a threshold rather than a spectrum, the Bill effectively splits the MSP market in two. Providers that meet it can evidence regulated status to security-conscious enterprise buyers; those that do not may find themselves excluded from procurement long before any regulator takes an interest.

Benefits of Cyber Security and Resilience Bill Compliance

Competitive Advantage

Stand out from competitors who aren't compliant
Access high-value contracts with regulated sectors
Demonstrate security maturity to clients

Business Benefits

Build stronger client trust and improve retention
Reduce cyber risk and incident costs
Improve your security posture

Direct References from HL Bill 32

Part 2, Section 9 - Managed Service Providers

Defines "relevant managed service provider" (RMSP) and "managed service". A managed service is provided under contract for ongoing management of IT systems (support, maintenance, monitoring, or active administration), where the provider connects to or accesses customer systems.

HL Bill 32, Part 2, Section 9, Regulation 1(3B)

Part 2, Section 10 - Duties of Managed Service Providers

Regulation 14B requires RMSPs to identify and take appropriate and proportionate measures to manage risks to network and information systems used to provide managed services, ensure a level of security appropriate to the risk, prevent and minimise impact of incidents, and have regard to Information Commission guidance.

HL Bill 32, Part 2, Section 10, Regulation 14B

Part 2, Section 14 - Registration Requirements

Regulation 14C requires RMSPs to register with the Information Commission within 3 months, providing company name, address, directors/partners, and contact details. Changes must be notified within 7 days. Regulation 14D requires non-UK RMSPs to nominate a UK representative within 3 months.

HL Bill 32, Part 2, Section 14, Regulations 14C and 14D

Part 2, Section 15 - Incident Reporting

Regulation 14E requires RMSPs to report incidents within 24 hours (initial notification) and 72 hours (full notification) to the Information Commission, with a copy to CSIRT simultaneously. Regulation 14G requires notification of affected UK customers as soon as reasonably practicable.

HL Bill 32, Part 2, Section 15, Regulations 14E and 14G

Part 2, Section 12 - Critical Suppliers

Regulation 14H allows the Information Commission to designate suppliers to RMSPs as critical suppliers if their failure could disrupt managed services and have significant impact on the economy or day-to-day functioning of society.

HL Bill 32, Part 2, Section 12, Regulation 14H

Part 2, Section 20 - Information Gathering

Regulation 15 gives the Information Commission power to require RMSPs to provide information or documents, obtain or generate information, and collect or retain information for regulatory purposes. Information notices can be sent to RMSPs whether or not they're established in the UK.

HL Bill 32, Part 2, Section 20, Regulation 15

Part 2, Section 21 - Financial Penalties

Regulation 18 sets maximum penalties: the greater of £17 million and 4% of turnover for serious failures (security duties, incident reporting, customer notification), and the greater of £10 million and 2% of turnover for standard failures (registration, UK representative, administrative requirements).

HL Bill 32, Part 2, Section 21, Regulation 18

Frequently Asked Questions

Are Managed Service Providers regulated under the CSRB?

Managed Service Providers are regulated under the Cyber Security and Resilience Bill as Relevant Managed Service Providers (RMSPs) if they provide ongoing IT management, support, maintenance, monitoring or active administration under contract and connect to or access customer systems. You are only an RMSP if you are not designated as a critical supplier under regulation 14H for that service, are not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC, and either are not subject to public authority oversight or derive more than half your income from commercial activities.

What is a managed service under the CSRB?

A managed service is a service provided under a contract for the provision of ongoing management of information technology systems for a customer, whether in the form of support and maintenance, monitoring, active administration or other activities. The service must be provided by the provider, or someone acting on its behalf, connecting to or otherwise obtaining access to network and information systems relied on by the customer. It does not matter whether that access is established on the customer's premises or remotely, and data centre services and public electronic communications networks and services are excluded.

What are the incident reporting requirements for MSPs?

MSPs regulated as RMSPs must give the Information Commission an initial notification within 24 hours and a full notification within 72 hours of first becoming aware of an RMSP incident, under Regulation 14E. A copy of each notification must be sent to CSIRT at the same time. After the full notification, Regulation 14G requires you to take reasonable steps to establish which UK customers are likely to be adversely affected and then notify them as soon as reasonably practicable.

Do MSPs have to register with the Information Commission?

MSPs regulated as RMSPs must register with the Information Commission within 3 months under Regulation 14C, giving their name and proper address, the names of their directors or partners, and up-to-date contact details. Any change must be notified in writing as soon as reasonably practicable and in any event within 7 days of the change taking effect. An RMSP whose principal office is outside the United Kingdom must also nominate a UK representative in writing within 3 months under Regulation 14D.

What are the penalties for MSPs under the CSRB?

MSPs face a higher maximum penalty of the greater of £17,000,000 and 4% of global turnover, for serious failures such as breaching the Regulation 14B security duties, failing to notify an incident under Regulation 14E, or failing to notify affected customers under Regulation 14G. Administrative failures carry a standard maximum of the greater of £10,000,000 and 2% of global turnover, and cover registration under Regulation 14C, the UK representative requirement in Regulation 14D, and sending a copy of an incident notification to CSIRT. Daily penalties may apply to continuing contraventions.

Need Help with MSP Cyber Security and Resilience Bill Compliance?

Our expert team helps Managed Service Providers implement and prove compliance with the Cyber Security and Resilience Bill (CSRB) - and do so in a way that enhances security without slowing innovation.

Talk to Our Compliance Experts Take Readiness Assessment