> regulatory.update —— legislation: Cyber Security and Resilience Bill —— status: PROGRESSING —— scope: EXPANDED —— preparation: START_NOW<span class="cursor-blink">_</span>_
The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to the House of Commons on the 12th of November 2025 and is currently progressing through Parliament. When enacted — expected later in 2026 — it will represent the most significant update to the UK's cyber security legislation since the original Network and Information Systems (NIS) Regulations came into force in 2018.
The Bill is the Government's response to the NCSC's warning of a 'widening gap between the increasingly complex cyber threats and the UK's defensive capabilities.' It expands the scope of regulated sectors, introduces enhanced incident reporting requirements, and gives regulators greater enforcement powers. If your business operates in or supports critical sectors, this Bill affects you — and preparation should begin now.
Prepare for your Cyber Essentials certification with our practical checklist covering all five technical controls.
The original NIS Regulations covered operators of essential services in six sectors — energy, transport, health, drinking water, digital infrastructure, and certain digital services. The new Bill expands this scope significantly.
| Change | What It Means for Your Business |
|---|---|
| Enhanced Incident Reporting | The Bill introduces stricter and faster incident reporting requirements. Organisations will be required to report significant cyber incidents to their sector regulator within defined timeframes. The reporting threshold is expected to be lower than the current NIS requirements, meaning more incidents will need to be reported. |
| Expanded Regulatory Powers | Sector regulators will gain enhanced enforcement powers, including the ability to issue directions, conduct audits, and impose penalties for non-compliance. The days of cyber security being a voluntary best-practice exercise for regulated sectors are ending. |
| Supply Chain Security Requirements | Regulated organisations will face obligations to assess and manage the cyber security risks in their supply chains. This means that if you supply services to a regulated organisation, you can expect to face contractual security requirements backed by regulatory obligation — not merely procurement preference. |
| Technical Standards | The Bill enables the Government to set minimum technical standards for cyber security in regulated sectors, potentially going beyond the current framework of voluntary guidance and certification. These standards may draw on existing frameworks such as the NCSC's Cyber Assessment Framework. |
| Step | Action |
|---|---|
| 1. Assess your scope | Determine whether your business is in a currently regulated sector, is likely to be brought within scope by the expanded definitions, or supplies services to organisations in regulated sectors. If any of these apply, the Bill affects you. |
| 2. Gap analysis against NCSC CAF | Conduct a gap analysis against the NCSC's Cyber Assessment Framework (CAF), which is likely to inform the technical standards set under the Bill. Identify where your current security posture falls short and prioritise remediation. |
| 3. Review your incident response plan | Ensure you have a documented, tested incident response plan that includes regulatory notification procedures. When the Bill's reporting requirements come into force, you will need to be able to report significant incidents quickly and accurately. |
| 4. Audit your supply chain | Assess the cyber security posture of your critical suppliers. Identify single points of failure. Incorporate security requirements into contracts. The Bill will make supply chain security a regulatory obligation, not merely a good practice. |
| 5. Achieve Cyber Essentials Plus | CE+ certification provides a verified baseline of security controls that aligns with the Bill's objectives. Achieving certification now positions your organisation favourably for compliance and demonstrates proactive security management to regulators, clients, and insurers. |
Our compliance readiness assessments evaluate your current security posture against the frameworks that will underpin the new legislation. From NCSC CAF gap analysis to Cyber Essentials Plus certification to incident response planning, we help you prepare for the regulatory landscape of 2026 and beyond.
Prepare for your Cyber Essentials certification with our practical checklist covering all five technical controls.