Security providers under the Cyber Security and Resilience Bill
Many managed security providers are likely to be regulated managed service providers under the Cyber Security and Resilience Bill (CSRB), because monitoring a customer’s systems under an ongoing contract is named in the definition. One-off penetration tests look different, though no guidance has settled the detail.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Why security providers deserve a separate look
Security providers often hold the most privileged access in a customer's environment. The Cyber Security and Resilience Bill (CSRB) defines a managed service as ongoing management of IT systems under contract, "whether in the form of support and maintenance, monitoring, active administration or other activities", provided through access to systems the customer relies on.
Disclosure: this site is run by Precursor Security, which sells security services. The analysis below is general and is not a statement of any provider's legal position.
Service by service
This is our reading of the text. Information Commission guidance may change it.
| Service | Likely position | Reasoning |
|---|---|---|
| 24/7 SOC or MDR with agents or log access | Probably in scope | Ongoing monitoring with access |
| Managed firewall or endpoint | Probably in scope | Active administration |
| Managed vulnerability scanning | Uncertain, leaning in scope | Depends on access and ongoing role |
| Continuous penetration testing | Uncertain | Ongoing, but is it "management" of the systems? |
| One-off penetration test | Probably out | Not ongoing management |
| Incident response retainer | Uncertain | Depends on standing access |
| Advisory or virtual CISO | Uncertain, leaning out | Depends on system access |
| Threat intelligence feed | Probably out | No access to customer systems |
| Security software as a service | Could be RDSP or managed service | Depends on cloud definition and support model |
What being in scope would mean
If you are an RMSP, the duties fall on your own security and incidents:
- Register with the Information Commission within three months of the relevant section starting.
- Take appropriate and proportionate measures, having regard to the state of the art and Information Commission guidance.
- Give the initial notification within 24 hours of first being aware of a reportable incident, and the full notification within 72 hours, copying each to the CSIRT.
- After the full notification, notify UK customers likely to be adversely affected, as soon as reasonably practicable.
Serious failures carry a maximum penalty of the greater of £17 million and 4% of turnover.
Two practical issues for security firms
You will see incidents from two sides. An attack on a customer that you detect is the customer's incident, unless it also affects systems you rely on to deliver your service. Your contract should say who decides, who reports and who supports evidence collection. Agree this now, because time will be short.
Your customers will ask. Regulated buyers will want evidence that you can meet your duties and support theirs. Prepare answers about your scope analysis, registration plans, incident handling and sub-processors.
Your tools and suppliers
A vendor directly supplying you could be designated as a critical supplier if the tests are met. Review which outside platforms your service depends on and how you would continue if one failed. A failure at a shared security platform could affect many customers at once.
What to do
- Assess each service line separately against the definition.
- Record access held, length of contract and what the service manages.
- Agree customer incident roles in contracts.
- Treat your own management tools as high-value targets, and test them.
Sources
Frequently asked questions
Probably, if it is above the size limits and monitors customer systems through access under an ongoing contract. Monitoring is expressly named in the definition of a managed service.
One-off testing does not look like ongoing management. A continuous or retained service involving standing access is less clear, and the Bill does not address it directly. Check each service you sell.
Yes, in principle, if it is not already regulated for that service and meets the designation tests. A person cannot be designated in relation to a service that already makes it an RMSP or RDSP.
The text does not say. A retainer with no standing access looks different from a service that keeps access to customer systems, so review how yours works and look out for Information Commission guidance.