Last updated: 7 November 2026
The Cyber Security and Resilience (Network and Information Systems) Bill is the biggest update to UK cyber law since 2018. It extends the NIS Regulations to managed IT service providers, data centres and critical suppliers, and requires significant incidents to be reported within 24 hours. Most small businesses are not regulated directly, but will feel it through their IT provider and their customers.
Where the Bill stands
As of our latest update on 28 September 2026 the Bill had completed the House of Commons and was at report stage in the House of Lords. Royal Assent is widely expected between late 2026 and spring 2027, with most practical duties following through secondary legislation from around 2028. Check the Parliament bill page for the current stage.
| Group | What changes |
|---|---|
| Managed service providers | Directly regulated for the first time, with registration and security duties aligned to NCSC guidance |
| Data centres | Brought into scope as essential infrastructure |
| Critical suppliers | Suppliers designated as critical to essential services take on security duties |
| Essential services (energy, transport, health, water, digital) | Stronger duties and wider incident reporting |
| All in scope | Significant incidents reported within 24 hours, with a fuller report within 72 hours; turnover-based penalties for serious failures |
How it reaches a small business
Through your IT provider
Managed service providers face stronger security and reporting duties, which raises standards for every client they support.
Through your customers
If you supply the NHS, councils, energy or transport, expect tougher security questionnaires and Cyber Essentials as a standard requirement.
What to do now
- Get Cyber Essentials, fast becoming the minimum supply-chain requirement
- Ask your IT provider how they are preparing and whether they are an NCSC Assured Service Provider
- Write an incident response plan that could support 24-hour reporting
- Review supplier access to your systems and data
- Keep evidence: policies, MFA settings, patching records and backup tests
How ABCOM helps
ABCOM is an NCSC Assured Service Provider and already works to NCSC standards. Read our full guide, UK Cyber Security and Resilience Bill 2026: where it is and what it means.
Quick answers
Is my small business covered by the Bill?
Most small businesses are not regulated directly, because the Bill targets essential services, data centres, managed service providers and designated critical suppliers. You may still need to meet its standards if you supply a regulated organisation.
What is the difference between this Bill and NIS2?
NIS2 is the EU directive. The UK Bill amends the existing UK NIS Regulations 2018 and is designed to align broadly with the direction of EU rules, but it is separate UK law.
Supply the NHS, a council or another regulated customer? We can check your readiness for free.
Related answers and guides
- UK Cyber Security and Resilience Bill: full guide
- What are supply chain attacks?
- NHS suppliers: DSPT and the Cyber Security Charter
- Why do businesses fail Cyber Essentials?
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about cyber security services. Free, friendly and no obligation.