Defence suppliers under the Cyber Security and Resilience Bill
Defence is not a listed sector under the Cyber Security and Resilience Bill (CSRB), so defence work does not itself bring a company into scope. A supplier can still be caught through other activities, such as managed IT services, cloud services or a data centre, and defence contract rules continue separately.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The position in brief
Schedule 2 of the NIS Regulations 2018 does not list defence, and the Cyber Security and Resilience Bill (CSRB) does not add it. Defence suppliers therefore need to ask a narrower question: does any company in the group carry on an activity the Bill regulates?
Routes to check
| Route | Defence-sector example | Note |
|---|---|---|
| RMSP | A prime's IT arm managing systems for other businesses | Assess the contracting company and size rules |
| RDSP | A secure cloud service sold to UK customers | Must meet the cloud definition |
| Data centre | A facility above 1 MW, or 10 MW for enterprise use | See the Crown carve-out below |
| Critical supplier | A firm directly supplying a regulated operator as well | Supply to the Ministry of Defence alone does not meet the test |
The classified data centre carve-out
Section 5 of the Bill applies the data centre rules to services provided by or on behalf of the Crown, with two exceptions:
- Services provided by the Security Service, the Secret Intelligence Service or GCHQ.
- Services provided on a commercial basis on behalf of the government, to the extent they enable storing, processing or transmitting material classified "secret" or "top secret".
"To the extent" matters. On our reading, a facility doing mixed work may need to separate what is excluded from what remains. Take advice before assuming the entire site is out.
National security directions
Part 4 lets the Secretary of State give a direction to a regulated person where a security or operational compromise, or its threat, creates a risk to national security and the direction is necessary and proportionate. It can come with non-disclosure requirements and its own penalty rules. If you are regulated, your legal and security teams should know how to handle one.
Defence contract rules still apply
The Bill doesn't replace the cyber requirements in defence contracts, such as those from the Ministry of Defence's cyber security model for suppliers. We have not mapped those requirements against the Bill here, so check your contracts and the current Ministry of Defence guidance separately. Expect two parallel sets of demands if you also serve regulated organisations.
Reporting can also overlap. An incident could trigger the Bill's 24-hour and 72-hour notifications, UK GDPR notifications and separate contract or security reporting. Keep sensitive details out of notifications unless the channel is approved for them, and decide your approach before an incident happens.
What to do
- Map group companies and services against the OES, RDSP and RMSP tests.
- Separate classified from unclassified services at any data centre.
- Review how a national security direction would be received and handled.
- Combine your reporting obligations into one incident plan.
Sources
Frequently asked questions
Not because they work in defence. A defence company can be regulated if it separately meets a test, such as providing a managed service or cloud service, or running a data centre above the threshold.
Partly. Crown-run data centres can be covered. The Bill excludes those of the Security Service, the Secret Intelligence Service and GCHQ, and commercial services for the government to the extent they store, process or transmit material classified secret or top secret.
Designation attaches to direct supply to an OES, RDSP or RMSP, so supplying the Ministry of Defence alone would not meet the test. A firm that also directly supplies a regulated organisation could be considered.
They apply to regulated persons. A defence supplier that is regulated could receive one, and a direction can prevail over conflicting regulatory requirements if the Secretary of State notifies it of the conflict.