Governance & Regulation
Cyber Security and Resilience Bill Readiness
The UK’s Cyber Security and Resilience Bill brings managed service providers, data centres and designated critical suppliers into the regulatory net for the first time. We help you work out whether you are in scope, what will be expected and how to evidence it — before the secondary legislation lands.
The challenge
If you manage someone else’s network, you are about to be regulated like it.
For years, managed service providers have held privileged access to the networks of the organisations that regulation was designed to protect — without being regulated themselves. The Cyber Security and Resilience Bill is designed to close that gap.
As introduced, the Bill brings managed service providers and data centres within scope, allows regulators to designate critical suppliers, strengthens incident reporting — including a 24-hour initial notification — and gives regulators stronger enforcement powers.
The detail will follow in secondary legislation and guidance. The direction will not change. Preparing now means you can answer customer questions with confidence, and meet regulatory expectations without a scramble.
What you get
Outcomes, not reports.
- 01
A clear scope position
A reasoned view of whether and how the Bill applies to you, which regulator is likely to oversee you, and what that means in practice.
- 02
Incident reporting that works
Detection, triage and notification processes capable of meeting a 24-hour initial notification, with customer notification built in.
- 03
Evidence your customers want
Controls and evidence aligned to the NCSC Cyber Assessment Framework — useful for regulators and for customer due diligence alike.
- 04
A proportionate plan
A roadmap that prioritises what the Bill is likely to require, without gold-plating ahead of the detail.
How we work
Senior-led from scoping to sign-off.
-
Scope
We assess your services, customers and dependencies against the Bill’s definitions as currently drafted.
-
Assess
A gap assessment against the NCSC Cyber Assessment Framework and the Bill’s incident-reporting and supply-chain provisions.
-
Plan
A prioritised roadmap covering governance, incident notification, supplier assurance and evidence.
-
Track
Optional ongoing support as secondary legislation, regulator guidance and codes of practice are published.
Deliverables
- Scope and applicability assessment
- CAF-aligned gap assessment
- Incident notification process design
- Readiness roadmap and board briefing
Who it’s for
- Managed service providers and managed security service providers serving UK customers
- Data centre operators
- Suppliers likely to be designated as critical to essential services
- Operators of essential services and their CISOs assessing supply-chain exposure
Aligned to
- Cyber Security and Resilience (Network and Information Systems) Bill
- NIS Regulations 2018
- NCSC Cyber Assessment Framework (CAF)
- Cyber Essentials
- ISO/IEC 27001
Questions
Frequently asked.
Is the Bill law yet?
Not yet. As at September 2026 the Bill is progressing through the House of Lords, with Royal Assent expected between late 2026 and 2027. Many substantive requirements will be set out in secondary legislation and regulator guidance, with obligations expected to take effect from around 2028. We track its progress and update our guidance accordingly.
Why prepare before the detail is final?
Because the direction is clear, the lead times are long, and your customers — especially operators of essential services — are already asking suppliers about their security and incident-reporting capability.
Often paired with
Regulatory Resilience & Control Assurance
DORA, GovAssure/CAF, CBEST, TIBER-EU, FedRAMP and ISO 27001 — assurance against the frameworks your regulators actually test.
Explore Regulatory Resilience & Control AssurancevCISO for AI
A senior CISO on a retained basis, accountable to your board — with AI and agent risk built in from day one.
Explore vCISO for AIAI-Incident Tabletop Exercises
Executive and operational exercises built around a rogue or compromised agent. Find the gaps before an incident — or a regulator — does.
Explore AI-Incident Tabletop ExercisesStart with a confidential conversation.
A confidential conversation about Cyber Security and Resilience Bill Readiness with the senior practitioner who would lead the work. No sales team, no obligation.