IT resellers and consultancies under the Cyber Security and Resilience Bill
Selling licences or doing one-off IT projects should not make you a regulated managed service provider under the Cyber Security and Resilience Bill (CSRB). Ongoing management of a customer’s IT under contract, with access to its systems, can, if your business is above the small enterprise limits.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The test in the Bill
The Cyber Security and Resilience Bill (CSRB) defines a managed service in new regulation 1(3B). It is a service that:
- Is provided under a contract with a customer for ongoing management of IT systems, whether as support and maintenance, monitoring, active administration or other activities.
- Is provided by connecting to or obtaining access to systems the customer relies on for a business or other activity. Access can be on-site or remote.
Data centre services and public electronic communications networks and services are excluded. Then the provider must also be in the UK market, above the micro and small limits, and not excluded by public authority oversight.
Applying it
The table below is our reading of the text. Nothing here has been confirmed by the Information Commission.
| What you do | Likely answer | Why |
|---|---|---|
| Licence or hardware resale only | Probably not | No ongoing management or access |
| One-off project or consultancy | Probably not | Not ongoing, unless access and support continue afterwards |
| Ad hoc break-fix | Uncertain, leaning no | Depends on how regular the work is |
| Monthly helpdesk with remote access | Probably yes | Support with access to customer systems |
| Monitoring and patching | Probably yes | Monitoring and administration are named or close to named activities |
| Managed Microsoft 365 administration | Probably yes | Active administration of a system the customer relies on |
| Subcontracted support for another MSP | Uncertain | Text doesn't limit "customer" to end users |
| Software with vendor support access | Uncertain | Could be managed service, RDSP or neither |
Warning signs that you have drifted into scope
Resellers often add services over time. Check for these:
- Admin credentials retained after a project finishes.
- A retainer or managed support line in your contracts.
- Remote monitoring and management tools installed on customer devices.
- Marketing that describes you as a managed service provider.
Marketing does not decide the legal test, but customers and regulators may ask why your description of yourself differs from your analysis.
If you are in scope
You would need to register with the Information Commission within three months of the relevant section starting, manage security risks, report significant incidents within 24 and 72 hours, and notify affected UK customers. The MSP checklist puts these in order. Providers with a principal office outside the UK must also nominate a UK representative.
If you are out of scope
You may still be affected. A regulator can designate a direct supplier of an RMSP or RDSP as a critical supplier if strict tests are met, and your regulated customers may ask you for security commitments.
What to do
- List each service you sell against the table.
- Record whether each contract includes ongoing access.
- Measure your size, including linked businesses.
- Write down your conclusion, and review it when guidance arrives.
Sources
Frequently asked questions
Not by itself. The definition requires a contract for ongoing management of the customer’s IT systems and access to systems the customer relies on. Add-on support or administration could change the answer.
It depends. Truly ad hoc call-out work looks less like ongoing management, but a long-term support contract with standing remote access looks more like it. The Bill’s examples expressly include support and maintenance.
Possibly. The definition refers to a contract with a customer and access to systems that the customer relies on, and does not say the customer must be the end user. Check how the arrangement works, and look for Information Commission guidance.
Micro and small enterprises are outside the RMSP definition. Use the Commission Recommendation test and check whether linked businesses count towards your size.