The UK Cyber Security and Resilience (CSR) Bill: An Overview
In April 2025, the UK government released a detailed policy statement outlining its legislative plans for the Cyber Security and Resilience (CSR) Bill. This new legislation is set to reshape the UK’s cyber regulatory landscape. It builds upon and significantly reforms the Network and Information Systems (NIS) Regulations 2018, and reflects changes introduced in the EU with the NIS 2 directive. The bill has a renewed focus on growing interdependencies across sectors and the crucial role of third-party suppliers and digital infrastructure.
The CSR Bill is expected to be introduced to Parliament mid-to-late 2025 (view my updated overview of the CSR Bill here). The Bill is poised to expand regulatory scope, strengthen enforcement powers, and tighten incident response requirements for a broader set of organisations.
Background to the CSR Bill, NIS, and the CAF
The NIS Regulations 2018
Implemented in the UK in response to the EU’s NIS Directive, the NIS Regulations 2018 were designed to strengthen the cybersecurity and resilience of Operators of Essential Services (OES) across sectors critical to national security, such as water, energy, and healthcare. These regulations also apply to digital service providers (search engines, online marketplaces, cloud computing, etc.), which are increasingly relied on by OESs to deliver their key services.
In scope entities were required to implement “appropriate and proportionate” security measures and report incidents within 72 hours to their sector-specific Competent Authorities (CAs), such as Ofgem for Operators of Essential Services (OES) and the Information Commissioner’s Office (ICO) for relevant Digital Service Providers (RDSP).
Although an important step, NIS was relatively narrow in scope, with inconsistent enforcement across sectors and limited reach into third-party risk and supply chains. Until the CSR Bill is introduced, the NIS regulations 2018 are still in force.
The Cyber Assessment Framework (CAF)
In support of the UK NIS implementation, the National Cyber Security Centre (NCSC) developed the Cyber Assessment Framework (CAF) – a set of cybersecurity and resilience principles which each define a broad cybersecurity outcome. Each principle is broken down further into a selection of lower-level contributing outcomes (CO), which in turn are broken down into a set of Indicators of Good Practice (IGP), all of which need to be achieved by an OES to satisfy the CAF principle.
Achieving all contributing outcomes goes well beyond basic cyber hygiene and requires a level of investment and resourcing that may outweigh the risk being mitigated. Each sector’s CA was tasked with defining a Target Profile, which represented the appropriate and proportionate cybersecurity for OES to achieve.
The CAF became a widely adopted framework used by regulators, such as Ofgem, for OESs to measure and improve cyber resilience. The CSR Bill intends to strengthen regulatory coherence across sectors using the CAF and turn the principles and objectives into guidance and regulatory expectations, giving regulators a uniform baseline for assessing compliance and risk. From our experience with other international regulatory frameworks, we anticipate that the CAF will be an annual, audited assessment for the in-scope critical organisations and a self-assessment for the less critical organisations.
The Network and Information Security Directive 2023 (NIS2)
The NIS 2 Directive, adopted by the EU in January 2023 and transposed into law in October 2024, is an update to the original NIS Directive (and NIS Regulation 2018). It broadens the scope to include more sectors and introduces stricter security requirements, tougher penalties, and enhanced oversight for supply chains and incident response.
Although the UK is no longer bound by EU law post-Brexit, the CSR Bill will mirror many of NIS2’s principles, such as expanding regulated sectors and strengthening enforcement, to maintain regulatory alignment and resilience in cross-border digital infrastructure. If your company operates in the EU and the UK, you will need to comply with both regulations.
Key Areas and changes of the CSR Bill from NIS 2018
The CSR Bill brings about significant changes and new regulatory mechanisms. These are:
- Expansion of scope: More organisations covered
- Incident reporting overhaul
- Stronger regulatory powers and technical security measures
Expansion of scope: More organisations covered
Managed Service Providers (MSPs) — The CSR Bill proposes to bring, as they have with NIS2, MSPs under the regulatory framework. These entities, which provide outsourced essential IT services to various sectors, will be required to implement robust cybersecurity measures and adhere to incident reporting protocols.
A managed service will be defined within the legislation; however, it is expected to follow four general principles:
- The service is provided to another organisation and;
- Relies on the use of network and information systems to deliver the service, and;
- Relates to ongoing management support, active administration and/or monitoring of IT systems, IT infrastructure, applications, and/or IT networks, including for the purpose of activities relating to cyber security, and;
- Involves a network connection and/or access to the customer’s network and information systems.
MSPs likely to fall under the scope may include:
- Managed IT services, infrastructure and application management
- IT remote support and systems integration, and management (SIAM)
- Managed security service provider (MSSP)
- Managed security operations centre (SOC)
- Security information and event management (SIEM)
- Incident response support
- Threat and vulnerability management
Data Centres — The Bill proposes to classify data centres as essential services. This would include any UK-based data centre with a capacity of 1MW or more (or 10MW for enterprise data centres), acknowledging their growing criticality.
Critical Suppliers — A new category of Designated Critical Suppliers (DCS) will be introduced. These are third parties whose compromise could seriously impact the operation of an essential or digital service.
Regulators will have the authority to identify, designate, and enforce compliance obligations on these suppliers. This will particularly impact those third parties which support OES, RDSPs, or businesses which the regulators may classify as critical national infrastructure.
Incident Reporting Overhaul
The CSR Bill will introduce a two-stage reporting model:
- Initial Notification within 24 hours of becoming aware of a significant incident to the UK’s Computer Security Incident Response Team (CSIRT), the NCSC.
- Comprehensive Incident Report within 72 hours to the UK’s CSIRT.
Organisations will also be required to inform impacted customers of significant incidents – a shift towards greater transparency and accountability, similar to what we have seen with NIS2.
Stronger regulatory powers and technical security measures
The Information Commissioner’s Office (ICO) and other regulators will be granted greater authority through the CSR Bill, which will provide them with the powers to:
- Collect information (including mandating registration),
- Conduct audits and investigations,
- Issue compliance notices and fines.
Companies will need to financially account for fees which will be imposed by regulators to recover their costs.
As mentioned about the NCSC’s CAF has been widely adopted by the OES regulator, Ofgem and other regulators to assess cyber risk. The CSR bill will likely update the requirements of the CAF, making it easier and mandatory to follow best practices. This means that aligning with the existing CAF will put your company in a stronger position when the Bill comes into force.
Steps to take now
We’ll cover how businesses can stay ahead of the UK’s Cyber Resilience Bill and strengthen their cyber resilience in more detail in future blogs, but as a starting point, we’d recommend:
1. Determine if you’re in scope of the CSR Bill
Work with your legal and compliance teams to determine whether you are in scope of the CSR Bill. Although the CSR Bill has not yet passed into law, its direction is clear. Businesses that are either in scope or adjacent to regulated sectors should identify which entities are covered and in which locations.
- Are you an MSP, data centre operator, or supplier to essential/digital service providers?
- Might you be designated as a critical supplier? Read our NIS 2 blog to help establish if your organisation is likely to be in scope.
If so, you will likely be brought into scope under the CSR regime. Your legal team will want to be tracking the status of implementation. You should also monitor for implementation guidance as it becomes available (although this will likely arrive after implementation, as was the case with the NIS2 and GDPR).
2. Familiarise yourself with CAF and other industry standards
We suggest you plan for a gap analysis, using the CAF as what ‘good’ might look like.
- Download and review the NCSC’s CAF.
- Begin benchmarking your current cyber maturity against CAF’s 14 principles.
Even if you’re not regulated yet, CAF is increasingly seen as a best practice standard with which to benchmark your cybersecurity posture. Additionally, aligning to recognised industry security frameworks such as ISO 27001:2022 is another way to begin.
3. Review incident response plans
Develop and test your cyber incident response plans:
- Ensure you have processes in place to detect and report incidents quickly.
- Rehearse your incident escalation and reporting protocols to meet the proposed 24-hour and 72-hour deadlines.
- Test and exercise your Incident Response plans at both the Executive and Operational levels.
4. Evaluate supplier risk
Enhance your supply chain security practices:
- Map your supply chain and understand which third parties provide services critical to your operations.
- Introduce supply chain risk management practices — vet suppliers’ cyber maturity and integrate them into your incident response framework.
- Conduct supply chain security due diligence on those critical third parties.
- Question any MSPs you have engaged how they are preparing for the CSR bill.
5. Prepare for engagement with regulators
Work with industry partners to develop frameworks for collating and presenting evidence to regulators.
- Expect increased communication and oversight from Competent Authorities.
- Budget for potential compliance costs or regulatory fees.
To stay informed, you can monitor the progress of the bill on the UK Parliament’s website, sign up for updates from the Department for Science, Innovation and Technology and look out for more of our follow-up blogs.
Need help with CSR?
If you need help with the UK Cyber Resilience Bill, please get in touch. We can help you identify your CSR scope and legal obligations, interpret guidance as it becomes available, conduct a gap analysis of your current security posture, develop improvement plans and lead improvement workstreams.
Evalian’s consultants are highly experienced in leading risk assessments, developing polices, conducting assurance activities and implementing security management systems covering IT and OT systems.
We are happy to simply assist with specific elements of your CSR readiness work, or we can take a more hands-on approach and guide and support your whole programme. Our supply chain security managed service, using our SupplyIQ tool, is perfectly suited to the supply chain security requirements.
