Manufacturing under the Cyber Security and Resilience Bill
Manufacturing is not a regulated sector under the Cyber Security and Resilience Bill (CSRB). A manufacturer can still be caught as a designated critical supplier, a large load controller, a data centre operator or a managed service provider, and many will face requirements from regulated customers.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The position in brief
The 2025 attack on Jaguar Land Rover was estimated by the Cyber Monitoring Centre to have cost the UK about £1.9 billion, with a range of £1.6 billion to £2.1 billion. Even so, the Cyber Security and Resilience Bill (CSRB) does not make manufacturing a regulated sector. Schedule 2 of the NIS Regulations 2018 covers named essential services, and the Bill's additions are data centres and large load controllers.
Routes that can apply
| Route | Manufacturer most likely to be affected | What decides it |
|---|---|---|
| Critical supplier | Maker of hard-to-replace equipment for energy, water, transport or healthcare operators | Direct supply, reliance on IT, availability of alternatives, and impact on the economy or society |
| Large load controller | Firm sending control signals to EV chargers, heat pumps or batteries | 300 MW or more of potential electrical control |
| Data centre operator | Group running its own data centre | 10 MW rated IT load on an enterprise basis |
| RMSP | Firm with a contract for ongoing IT management at customers | Definition and size test |
| RDSP | Firm running a cloud platform for customers | Definition and size test |
Designation is not automatic. A regulator must consult, give written reasons and allow you to make representations before it designates you. The government says critical supplier requirements will not be more stringent than those on regulated organisations, and that the specific duties will be consulted on.
The grey area: connected products and remote support
The managed service definition refers to ongoing management of "information technology systems", in the form of support, monitoring, administration or other activities, through access to systems the customer relies on. The Bill's text does not say whether connected machinery or industrial control systems count.
This is an open question, and our reading is that a manufacturer with long-term remote access to customer networks should not assume it is outside. Record your analysis, and revisit it when the Information Commission publishes guidance.
Where pressure will come from first
Regulated customers must manage risks to the systems they rely on, so expect questions in procurement. Those questions may reach you long before any regulator does. Prepare a short pack covering your certifications, incident contacts, recovery plans and security ownership. Our supplier guide explains how to answer.
Products have their own rules too. UK consumer connectable products fall under the PSTI regime, and products sold in the EU may fall under the Cyber Resilience Act. See the UK cyber security laws map.
What to do
- List customers in regulated sectors and what you supply to each.
- Ask whether they could replace you quickly. If not, treat critical supplier designation as possible.
- Review contracts for remote access to customer networks.
- Test recovery of production-critical systems, not just office IT.
Sources
Frequently asked questions
Not as a sector. Individual manufacturers can be caught through specific routes, such as critical supplier designation or controlling large numbers of energy smart appliances.
Yes, if it directly supplies goods or services to a regulated organisation, relies on network and information systems for that supply, and a regulator considers disruption likely to have a significant impact on the economy or society.
It is unclear. A managed service is ongoing management of IT systems under contract, with access to the customer’s systems. Remote monitoring of industrial equipment may or may not count, so watch for Information Commission guidance and take advice.
Making the device is not enough. A load controller threshold depends on controlling electricity flow through load control signals, at 300 megawatts or more of potential electrical control across relevant appliances.