# Near Miss Reporting Under the Cyber Security and Resilience Bill: What Changed

> Near misses do not have to be reported under the Cyber Security and Resilience Bill (CSRB). Government amendments at Lords Report Stage on 26 October 2026 limited incidents to events with an actual adverse effect, and removed near-miss reporting for data centres. A voluntary near-miss mechanism has been promised instead. The Bill is not yet law.

Canonical page: https://cybersecurityandresiliencebill.com/near-miss-reporting

## Status

The Bill passed the House of Lords on 2 November 2026 and returns to the Commons to consider Lords amendments. It is not yet law. References are to [HL Bill 62](https://bills.parliament.uk/publications/68323/documents/8980) (as amended on Report); the incident tests are in [clause 15](https://cybersecurityandresiliencebill.com/the-bill/part-2-nis-regulations#clause-15) (new regulations 11, 11A, 12A and 14E). The same tests would apply to operators of essential services, digital service providers and [relevant managed service providers](https://cybersecurityandresiliencebill.com/glossary/relevant-managed-service-provider). See [which regulator covers you](https://cybersecurityandresiliencebill.com/guides/which-regulator-covers-you), [the NIS Regulations vs the Bill](https://cybersecurityandresiliencebill.com/guides/nis-regulations-vs-the-bill), the [clause-by-clause guide](https://cybersecurityandresiliencebill.com/the-bill) and the glossary entries for [incident](https://cybersecurityandresiliencebill.com/glossary/incident) and [near miss](https://cybersecurityandresiliencebill.com/glossary/near-miss).

## What changed at Report Stage

- **HL Bill 32 (June 2026)** widened the definition of "incident" in regulation 1(2) of the NIS Regulations to events "having, or capable of having" an adverse effect. It also required data centres (regulation 11A) to report incidents that "could have had" a significant impact.
- **HL Bill 62 (26 October 2026)** removes both. An incident must have an actual adverse effect on the operation or security of network and information systems. A data centre incident is one which "has had, is having or is likely to have" a significant impact.
- The minister, Baroness Lloyd of Effra, said: "The Bill now makes it clear that an incident is an event which has had an actual adverse impact on the security and operations of an entity's systems." She committed to "a voluntary near-miss reporting mechanism for all regulated entities", to be set up without primary legislation ([HL Deb 26 October 2026, via TheyWorkForYou](https://www.theyworkforyou.com/lords/?id=2026-10-26b.961.0)). It does not exist yet.

## What is a near miss?

A near miss is an event that could have compromised the availability, authenticity, integrity or confidentiality of systems or data, but did not affect them. Examples: a phishing email reported before anyone entered credentials, an exploit attempt blocked by a web application firewall, a DDoS absorbed before the service was affected.

An incident has an actual adverse effect on the operation or security of systems. Only incidents can be reportable, and only if the impact is or is likely to be significant.

## Is it reportable? (our reading)

| Event | HL Bill 32 (June 2026) | HL Bill 62 (current) |
| --- | --- | --- |
| Attack blocked at the perimeter, no effect on any system | An incident under the wider definition, but outside the reporting tests for OES, RDSPs and RMSPs. Data centres had to report if it could have had a significant impact. | Not an incident. Not reportable. Log it, and share it voluntarily once the mechanism exists. |
| Attacker gains a foothold but is contained before any disruption | Reportable if the impact was or was likely to be significant. | Still an incident, because security was actually affected. Reportable if the impact is or is likely to be significant. |
| Data centre cooling attack stopped just before an outage | Reportable to Ofcom under the "could have had" test. | Reportable only if it has had, is having or is likely to have a significant impact. |
| Ransomware encrypts production systems | Reportable: 24-hour initial and 72-hour full notification. | Reportable: 24-hour initial and 72-hour full notification. |

## Why log near misses anyway

- It shows regulators and auditors that your detection works.
- It helps you spot patterns before they become incidents.
- It prepares you for the voluntary mechanism the Government has promised.
- It speeds up the decision about whether an event has crossed into a reportable incident, which matters because the 24-hour clock runs from awareness.

## Frequently asked questions

### Do near misses have to be reported under the Cyber Security and Resilience Bill?
Not any more. HL Bill 32 widened the incident definition to events "capable of having" an adverse effect and required data centres to report incidents that "could have had" a significant impact. Government amendments at Lords Report Stage on 26 October 2026 removed both. In HL Bill 62, an incident must have an actual adverse effect, and there is no mandatory near-miss reporting.

### Does an attack that was stopped still need reporting?
It depends on how far it got. If the attacker never affected a system, it is a near miss and not reportable. If they gained access, security was actually affected, so it is an incident, and it must be reported within 24 hours if its impact is or is likely to be significant.

### What is a near miss in the context of data breaches?
An event where personal data could have been exposed but was not. UK GDPR only requires reporting of actual personal data breaches that pose a risk to individuals, so near misses are not reportable to the Information Commission (the ICO until 30 September 2026).

### Should we still log near misses?
Yes. It is good practice, not a legal duty under the Bill.

## Related

- Breach vs incident vs near miss: https://cybersecurityandresiliencebill.com/guides/breach-vs-incident-vs-near-miss
- Near-miss log template: https://cybersecurityandresiliencebill.com/guides/near-miss-log-template
- What counts as a significant incident: https://cybersecurityandresiliencebill.com/guides/what-is-a-significant-incident
- Incident reporting: https://cybersecurityandresiliencebill.com/incident-reporting

## Sources

- HL Bill 62 (as amended on Report): https://bills.parliament.uk/publications/68323/documents/8980
- Lords Hansard, Report Stage, 26 October 2026: https://hansard.parliament.uk/Lords/2026-10-26/debates/B413EFAE-E7D4-4742-986D-092884E0D8D1/CyberSecurityAndResilience(NetworkAndInformationSystems)Bill