As of 9 October 2026, the GOV.UK Bill page says the Cyber Security and Resilience Bill has completed its second reading and committee stage in the House of Commons. This post covers where the Bill stands and what the government’s April 2025 policy statement says it plans. It uses only those two GOV.UK pages. Neither gives a royal assent date.
Where does the Cyber Security and Resilience Bill stand in 2026?
The Department for Science, Innovation and Technology runs the GOV.UK collection page, which shows a last update of 18 November 2025. It says the government introduced the Bill to Parliament for its first reading on 12 November 2025. It says the Bill will reform and add to the Network and Information Systems (NIS) Regulations 2018. For the latest position, the page says the Bill has now completed its second reading and committee stage in the House of Commons, and it points readers to the Parliament website for the passage of the Bill.
The same page lists factsheets explaining the measures in the Bill, dated 30 June 2026. The pages give no royal assent date, and this post does not estimate one. An NCSC blog post by its Director of National Resilience also says the Bill was introduced to Parliament on 12 November 2025 and, if the proposals are adopted, would bring more organizations and suppliers into scope of the NIS Regulations, including data centers, Managed Service Providers and critical suppliers.
- July 2024King’s SpeechThe government announced it would introduce a Cyber Security and Resilience Bill.
- 1 April 2025Policy details addedThe collection page added the Bill policy statement, press notice, ministerial statement and NCSC blog.
- 9 April 2025Policy statementThe policy paper is dated 9 April 2025.
- 12 November 2025IntroducedThe Bill was introduced to Parliament for its first reading.
- 18 November 2025Impact assessmentThe page links to the Regulatory Policy Committee rating of the impact assessment as fit for purpose.
- 30 June 2026FactsheetsThe factsheets explaining the measures in the Bill carry this date.
What does the policy statement say the Bill would change?
The government policy statement says the Bill will make substantial improvements to the existing framework by bringing more entities into scope and putting regulators on a stronger footing. It says the 2018 Regulations cover five sectors (transport, energy, drinking water, health and digital infrastructure) and some digital services (online marketplaces, online search engines and cloud computing services). It says twelve regulators enforce them.
It also says the Bill will provide the Secretary of State with powers to make regulations updating the existing technical requirements, and to issue a code of practice on how the requirements should be met. For regulators, it describes new fee and cost recovery powers, and more information-gathering powers for the Information Commissioner’s Office.
Which organizations would come into scope?
The policy statement says the Bill will bring managed service providers (MSPs) into scope, with the Information Commissioner’s Office as their regulator. It describes a managed service as one provided to another organization, not in-house, that involves ongoing management support, active administration or monitoring of IT systems. It estimates the measure would secure a further 900-1100 MSPs. It adds that exact wording is subject to final drafting.
The statement also lists four additional measures under consideration, including bringing data centers into scope. It says UK data centers would be in scope at or above 1MW capacity, while enterprise data centers would be in scope at or above 10MW. It says the government will consider the most appropriate legislative vehicle in due course, which could be this Bill. The pages do not say whether data centers are in the Bill as introduced.
| Topic | NIS Regulations 2018 | Plans in the policy statement |
|---|---|---|
| Reportable incidents | An incident must have resulted in interruption to the continuity of the essential or digital service. | The Bill would also capture incidents capable of having a significant impact on the service, and incidents that significantly affect confidentiality, availability and integrity. |
| Small and micro digital service providers | Currently exempt from the 2018 Regulations. | Regulators may designate a smaller provider as a critical supplier if it meets the designation criteria. |
| Technical requirements | Statutory expectations on standards and methods relate only to digital services firms. | The requirements would be updated and, where appropriate, could be extended to operators of essential services. |
What would change for incident reporting?
The policy statement says the Bill will introduce a two-stage reporting structure. Regulated entities would notify their regulator and inform the NCSC of a significant incident no later than 24 hours after becoming aware of it, followed by an incident report within 72 hours. It says they report to the regulator and inform the NCSC at the same time. It also says digital service firms and data centers with a significant incident will be required to alert customers who may be affected.
A question that follows from the 24 hour figure: can your team tell, within a day, whether an incident is significant and who must be told? An incident response plan is one place to write that down. For how this compares with other regimes, see our post on NIS2 transposition status in 2026.
What does it say about supply chains?
The policy statement cites the NIS 2018 Second Post Implementation Review for one figure: less than one tenth of operators of essential services feel confident in managing the risk from their wider supply chains. It says the Bill will let government set stronger supply chain duties in secondary legislation, subject to consultation. Examples it gives are contractual requirements, security checks and continuity plans. It also says regulators will be able to designate critical suppliers, which it expects to be a very small number of suppliers.
For the vocabulary, see the glossary entry on third-party risk. For the EU side of the same topic, see NIS2 and DORA third-party risk management.
How does the UK Bill relate to NIS2 and the threat picture?
The policy statement says the Bill will align, where appropriate, with the approach taken in the EU NIS 2 directive. On reporting times, it says the government intends the procedure to be similar to, and no more onerous than, the equivalent NIS2 requirements. The statement quotes the NCSC Annual Review 2024, which describes the threat landscape as diffuse and dangerous. Our post on the NCSC Annual Review 2025 covers the later review.
Does the policy statement match the Bill text?
This post summarizes two GOV.UK pages and is not legal advice. For dated obligations under other regimes, see our cyber compliance calendar for 2026 and 2027.
Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.
For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.