Contact 
Following a series of high-impact cyber incidents affecting public services, infrastructure providers and supply chains, the UK Government is strengthening its cyber security regulatory framework through the Cyber Security and Resilience (Network and Information Systems) Bill.
Introduced to Parliament in November 2025, the legislation is currently progressing through parliamentary scrutiny and is intended to significantly expand the UK’s cyber security obligations for organisations operating in essential services and trusted digital supply chains.
Building on the existing Network and Information Systems (NIS) Regulations 2018, the Bill aims to improve national resilience by introducing stronger governance requirements, faster incident reporting and enhanced regulatory powers.
For many organisations, particularly those providing digital services to government, healthcare, and critical infrastructure sectors, the reforms are likely to bring greater regulatory oversight and accountability for cyber risk management.
Key Proposals
Expanded Regulation for Digital and Critical Service Providers
One of the most significant changes is the expansion of organisations falling within regulatory scope.
In addition to traditional operators of essential services such as energy, transport, healthcare and water, the proposed legislation is expected to include:
- Managed Service Providers (MSPs)
- IT management and helpdesk service providers
- Cyber security service providers
- Data centres and digital infrastructure providers
- Suppliers critical to the delivery of essential services
These organisations often have privileged or trusted access to sensitive systems, including government networks, critical national infrastructure and large enterprise environments. Bringing them into scope aims to reduce systemic risk across supply chains.
Mandatory Incident Reporting and Resilience Planning
The Bill introduces more stringent incident reporting requirements for organisations operating within regulated sectors.
Organisations will be expected to:
- Report significant cyber incidents promptly
- Provide follow-up reports with technical and operational details
- Demonstrate the existence of effective incident response and resilience plans
The intention is to ensure that regulators gain earlier visibility of emerging threats and that organisations are capable of responding quickly to minimise disruption to essential services.
Designation of Critical Suppliers
Regulators will also gain powers to designate specific organisations as critical suppliers where their products or services are essential to national infrastructure or public services.
Examples could include providers involved in:
- healthcare diagnostics
- water treatment chemicals
- specialised digital infrastructure
- key technology components within supply chains
Once designated, these suppliers may be required to meet minimum cyber security and resilience standards, helping to close supply chain vulnerabilities that have been increasingly exploited in cyber attacks.
Stronger Enforcement and Penalties
The proposed legislation also introduces stronger enforcement mechanisms.
Regulators will have greater powers to investigate security failings and impose penalties where organisations fail to meet required standards. Proposed fines could reach up to £17 million or 4% of global annual turnover, depending on the nature and severity of the breach.
These measures are designed to ensure that organisations responsible for essential services maintain robust and resilient cyber security practices.
Powers for the Secretary of State
The legislation also provides additional powers to the Secretary of State for Science, Innovation and Technology to intervene where necessary to protect national security or critical services.
This may include directing regulators or organisations to implement specific cyber security measures, enhanced monitoring or other proportionate protections where risks are identified.
What This Means for Organisations
The direction of travel is clear: cyber resilience is becoming a regulatory expectation rather than a discretionary investment.
Organisations operating within essential service ecosystems should expect:
- Increased regulatory scrutiny
- Stronger accountability for cyber risk governance
- Greater expectations around incident response readiness
- More rigorous oversight of supply chain cyber security
Importantly, regulators are likely to place increasing emphasis not just on whether security controls exist, but on whether organisations can demonstrate that those controls are effective, proportionate and embedded within governance structures.
This reflects a broader shift towards assurance-based regulation, where organisations must be able to evidence resilience rather than simply document policies.
How Organisations Can Prepare
Although the legislation is still progressing through Parliament, organisations can begin preparing now by:
- Reviewing whether their services could fall within the expanded regulatory scope
- Assessing their role within critical supply chains
- Strengthening incident detection and reporting capabilities
- Reviewing third-party cyber risk management
- Aligning cyber governance with recognised frameworks such as the NCSC Cyber Assessment Framework
Early preparation will help organisations adapt more smoothly as the regulatory framework evolves.
Final Thoughts
The Cyber Security and Resilience Bill reflects a broader shift in how governments approach cyber risk. As essential services become more digital and interconnected, national resilience increasingly depends on the security of both operators and their supply chains.
For organisations in these ecosystems, cyber resilience is becoming a baseline expectation for operating in critical sectors. Understanding whether your organisation may fall within scope of the legislation, and ensuring governance and controls can withstand regulatory scrutiny, will be key.
For expert guidance or tailored support in preparing for the Cyber Security and Resilience Bill, contact our specialist team here to start a conversation.
