Public Services Cyber Security and Resilience Bill Compliance Guide
How the Cyber Security and Resilience Bill applies to local authorities, councils and government departments. Public bodies are not regulated as a category; they are caught only through specific routes such as running an essential service above a NIS Schedule 2 threshold.
Last updated: 14 September 2026
Sector Overview
Public services - including local authorities, government departments, and public agencies - are fundamental to the UK's national infrastructure. They deliver vital services like housing, education, social care, and emergency response. The Cyber Security and Resilience Bill (HL Bill 32) does not regulate public bodies as a category. A public body is regulated as an Operator of Essential Services (OES) only where a specific service it provides meets a NIS Schedule 2 sector threshold. For council-specific detail, see our local councils guide.
Why Public Services Are In Scope
Under Part 2, Section 3 of HL Bill 32, Regulation 8 identifies operators of essential services by reference to the sector thresholds in NIS Schedule 2. Local authorities, councils and government departments are not named in Schedule 2 or in Regulation 8. Under the Cyber Security and Resilience Bill a public body is in scope as an OES only where a service it provides meets a Schedule 2 threshold, for example Transport for London as a metro operator with more than 50 million annual journeys. Housing, social care, benefits and other public digital services are not a route into scope. Public authority oversight under Part 2, Section 11 is an exemption from digital and managed service provider status, not a route in.
You may be affected if you:
- Provide a service that meets a NIS Schedule 2 sector threshold, such as a large port or aerodrome, a metro, or a road authority, making you an operator of essential services for that service
- Provide cloud computing services, online marketplaces, search engines or managed services and are either not subject to public authority oversight, or are subject to it but derive more than half your income from commercial activities (RDSP or RMSP)
- Are designated as a critical supplier to a regulated OES, RDSP or RMSP under Regulation 14H
- Work with third-party providers that fall under Cyber Security and Resilience Bill scope (cloud services, MSPs), which will change your contracts and procurement even if you are not regulated yourself
Public Authority Oversight:
Under Part 2, Section 11 of HL Bill 32, a person is subject to public authority oversight if they are subject to the management or control of one or more UK public authorities, or a board more than half of whose members are appointed by UK public authorities. This is an exemption limb for RDSP (Section 7) and RMSP (Section 9) status only. A body subject to public authority oversight is caught as an RDSP or RMSP only if it derives more than half its income from commercial activities; one earning half or less of its income commercially is outside those categories. The test has no bearing on OES status.
Security Duties - Regulation 10
As an Operator of Essential Services (OES), you must comply with security duties under Regulation 10 of the NIS Regulations:
- Take appropriate and proportionate technical and organisational measures to manage risks posed to the security of network and information systems on which you rely for the provision of the essential service
- Take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting the security of those network and information systems
- Have regard to any relevant guidance issued by your designated competent authority
Incident Reporting Requirements - Regulation 11
Under Part 2, Section 15 of HL Bill 32, Regulation 11 sets out strict incident reporting requirements:
⚠️ Critical Timeline:
Required Information in Full Notification:
- Your name and the essential service to which the incident relates
- The time the incident occurred, its duration and whether it is ongoing
- Information concerning the nature of the incident
- Where the incident was caused by a separate incident affecting another regulated person: details of that separate incident and of the regulated person
- Information concerning the impact (including any cross-border impact) which the incident has had, is having or is likely to have
- Such other information as you consider may assist the designated competent authority
Reporting Requirements:
Notifications must be in writing, provided in such form and manner as the designated competent authority determines. You must send a copy of the notification to CSIRT (Computer Security Incident Response Team) at the same time as sending it to the designated competent authority.
- HL Bill 32, Part 2, Section 15, Regulation 11
Information Requests & Inspections
Under Part 2, Section 20 of HL Bill 32, Regulation 15 gives designated competent authorities powers to:
- Require you to give such information or documents as it reasonably requires for exercising its functions
- Require you to obtain or generate information or documents
- Require you to collect or retain information that you would not otherwise collect or retain
- Send information notices whether or not you're established in the UK
- Request information or documents stored within or outside the United Kingdom
⚠️ Important:
Failure to comply with an information notice is a breach that can result in penalties. Under Schedule 1, Regulation 16, regulators can inspect your premises, examine documents, test your systems, and interview your staff.
- HL Bill 32, Part 2, Section 20, Regulation 15; Schedule 1, Regulation 16
Penalties for Non-Compliance
Under Part 2, Section 21 of HL Bill 32, Regulation 18 sets out financial penalties:
Higher Maximum Amount (Serious Failures):
Maximum: the greater of £17,000,000 and 4% of global turnover for failures including security duties and incident notification, including the timing and content of notifications
Standard Maximum Amount (Administrative Failures):
Maximum: the greater of £10,000,000 and 2% of global turnover for failures including registration and information provision
- HL Bill 32, Part 2, Section 21, Regulation 18
Benefits of Cyber Security and Resilience Bill Compliance
Service Continuity
- Reduces risk of service outages and data loss affecting residents
- Improves cyber maturity across departments
- Builds trust with residents and supports continued funding
Governance & Strategy
- Demonstrates responsible digital governance to auditors and central government
- Access to guidance from designated competent authorities
- Better positioning for future digital transformation initiatives
Direct References from HL Bill 32
Part 2, Section 3 - Identification of Operators of Essential Services
Regulation 8 identifies operators of essential services by reference to the sector thresholds in NIS Schedule 2. It does not name local authorities, councils or government departments; a public body is an OES only where a service it provides meets a Schedule 2 threshold.
HL Bill 32, Part 2, Section 3, Regulation 8
Part 2, Section 11 - Subject to Public Authority Oversight
Regulation 1(3E) defines public authority oversight for the RDSP and RMSP definitions. A public body subject to oversight is caught as an RDSP or RMSP only if it derives more than half its income from commercial activities. The test does not affect OES status.
HL Bill 32, Part 2, Section 11, Regulation 1(3E)
Frequently Asked Questions
Are local authorities regulated under the CSRB?
Not as a category. Local authorities, councils and government departments are not named in NIS Schedule 2 or in Regulation 8. Under the Cyber Security and Resilience Bill a public body is an Operator of Essential Services only where a service it provides meets a Schedule 2 sector threshold, for example Transport for London as a metro operator with more than 50 million annual journeys. A public body can be a Relevant Digital Service Provider or Relevant Managed Service Provider only if it is not subject to public authority oversight, or is subject to it but derives more than half its income from commercial activities. Housing, social care and other council digital services are not a route into scope.
What is public authority oversight under the CSRB?
A person is subject to public authority oversight under the Cyber Security and Resilience Bill if they are subject to the management or control of one or more UK public authorities, or of a board more than half of whose members are appointed by UK public authorities. This matters because it is an exemption from Relevant Digital Service Provider and Relevant Managed Service Provider status: a body subject to public authority oversight that derives half or less of its income from commercial activities is outside those two categories. It is caught only if it is not subject to oversight, or is subject to oversight but derives more than half its income commercially. The test has no bearing on Operator of Essential Services status. Public authority oversight is defined by Regulation 1(3E), inserted by Part 2, Section 11 of HL Bill 32.
How quickly must a council report a cyber incident under the CSRB?
A local authority regulated as an Operator of Essential Services must give an initial notification within 24 hours of first becoming aware of an OES incident and a full notification within 72 hours, under Regulation 11. Notifications must be in writing and in the form and manner the designated competent authority determines, and a copy must be sent to CSIRT at the same time.
What powers do regulators have over public sector bodies?
Designated competent authorities can require public sector bodies to give, obtain, generate, collect or retain information and documents under Regulation 15, whether or not the body is established in the UK and whether the material is stored inside or outside the UK. Under Schedule 1, Regulation 16, regulators can also inspect premises, examine documents, test systems and interview staff. Failure to comply with an information notice is a breach that can result in penalties, although privileged legal advice does not have to be given.
What penalties can local authorities face under the CSRB?
A local authority regulated under the Cyber Security and Resilience Bill faces a higher maximum penalty of the greater of £17,000,000 and 4% of global turnover for failures to meet security duties or incident notification requirements, including the timing and content of notifications. Failures such as registration and copying incident notifications to CSIRT carry a standard maximum of the greater of £10,000,000 and 2% of global turnover under Regulation 18.
Need Help with Public Services Cyber Security and Resilience Bill Compliance?
Our expert team helps local authorities and government departments implement and prove compliance with Cyber Security and Resilience Bill requirements.