The UK Cyber Security and Resilience (CSR) Bill: An Updated Overview 

In April 2025, the UK government released a detailed policy statement outlining its legislative plans for the Cyber Security and Resilience (Network and Information Systems) Bill. This new legislation is set to reshape the UK’s cyber regulatory landscape. It builds upon and significantly reforms the Network and Information Systems (NIS) Regulations 2018, and reflects changes introduced in the EU with the NIS 2 directive. The bill has a renewed focus on growing interdependencies across sectors and the crucial role of third-party suppliers and digital infrastructure.  

The UK’s CSR Bill was introduced to Parliament on 12th November 2025, aiming to deliver a step-change in the UK’s cyber-defence posture. The Parliamentary factsheets provide additional details which have been summarised in this blog, where we cover:  

• Changes to who’s in scope, addition of data centres as CNI and inclusion of suppliers to CNI having the potential to be in scope 

• The core requirements, including incident reporting within 24 hours 

• Details changes to regulatory enforcement, including fines up to £17 million 

• A reminder of the key steps to take now 

Implementation of the CSR Bill

The Bill is still at its introductory stage, so nothing changes immediately. The Government has set out an implementation strategy which will take effect once the Act has passed through Parliament, with requirements being introduced gradually. 

The first phase will involve the registration of organisations. Once the regulation takes effect, entities within scope will have three months to register with their designated competent authority. After this, we expect the incident-reporting duties to be enforced, along with clearer guidance on what qualifies as a significant incident, reflecting the approach seen under NIS2. 

The more detailed obligations will be set out in secondary legislation. As the threat landscape evolves quickly, the Bill also allows new sectors or duties to be introduced without always requiring new primary legislation. 

Change to who’s in scope 

As discussed in my first blog on the CSR Bill, one of the major changes is the expansion of which organisations that fall within scope: 

• Original scope of NIS (2018) 

• Operators of Essential Services (OES): The existing scope remains (energy, transport, health, water, digital infrastructure), but the regime will be broader and more demanding. 11 different regulators will cover this space across the 4 regions. 
• Relevant Digital Service Providers (RDSPs): These include cloud-computing services, online marketplaces and search engines. The Bill will align more tightly with contemporary digital service models. The Information Commission (IC) (formerly the Information Commissioner’s Office, or ICO) will act as the regulator, providing oversight, support and enforcement. 

New additions for the CSR Bill 

• Relevant Managed Service Providers (RMSPs): Possibly the biggest addition. MSPs deliver critical IT services and have privileged access to networks or infrastructure managed for others. The Bill proposes bringing many of these into scope (UK research estimates indicate around 1,200 might be impacted) – The IC will act as the regulator, providing oversight, support and enforcement. 

• Data Centres: The Bill treats data centres as an Operator of Essential Service (OES) as they form part of the UK’s Critical National Infrastructure (CNI). This means that the Bill brings data centres into scope by classifying data infrastructure as a relevant sector and data centres as an essential service. The Department for Science, Innovation and Technology (DSIT) and Ofcom will act as joint regulators, with Ofcom serving as the operational regulator.  

• Large Load Controllers: These organisations are those that control electrical load to and from energy appliances; they will therefore be brought into scope by classifying them as an essential service if they have the potential to control more than 300MW. The Department for Energy Security and Net Zero (DESNZ) and Ofgem will be joint regulators. 

• Critical Suppliers: An important new addition, regulators will be empowered to determine “Designated Critical Suppliers” (DCS) whose disruption would pose a serious risk to OES, RDSP and RMSP. These suppliers will face obligations similar to regulated entities.  

Core requirements 

Entities in scope will face several key duties: 

• Risk-management & security controls: They must implement proportionate, effective security controls aligned with the National Cyber Security Centre Cyber Assessment Framework (CAF) or equivalent technical standards. 

• Incident-reporting: The Bill enhances the duty to report. Organisations will need to notify a significant cyber-incident (affecting confidentiality, integrity or availability) within 24 hours of awareness, with a more detailed report within 72 hours.  

• Supply-chain resilience: Regulated entities will be required to impose obligations on their suppliers contractually, by security checks, and business continuity planning. 

Regulators: enforcement & consequences 

This Bill signals significantly tougher enforcement. The 13 Regulators will have enhanced powers (inspection, investigation, cost-recovery) and the potential for heavier penalties for non-compliance or failure to report. The government has suggested penalties “turnover-based” similar to those imposed by the GDRP. It proposes fines: 

• For serious breaches – Up to £17 million, or 4% of a regulated entity’s worldwide turnover, whichever is higher, and  

• For less serious breaches – Up to £10 million, or 2% of a regulated entity’s worldwide turnover, whichever is higher.   

The definition of a serious or less serious breach is yet to be defined. The bill outlines consultation steps which the Government will manage to ensure the 13 regulators will implement appropriate sectoral risk measures in a consistent manner.  

Information sharing 

The government is also introducing a method for information sharing among regulators, UK intelligence agencies and law enforcement to ensure a deep understanding of the cyber risks and mitigations across the sectors. This may impact organisations with additional reporting; however, the Government are aiming to minimise this. 

Steps to take now 

For organisations subject to the bill and increasingly those in their supply chains, we’d recommend: 

• Assess whether you are in-scope: OES, RDSP, RMSP, data-centre, large-load-controller, critical-supplier. 

• Prioritise incident response readiness: ensure detection, notification and remediation capability is rapid. 

• Review supplier contracts and third-party risk: ensure obligations cascade and that business-continuity plans exist. Capture all your suppliers and begin categorising them into critical tiers. 

• Align with frameworks: Benchmark against the NCSC CAF (this is the likely framework required) and align to equivalent frameworks to strengthen your position (e.g., ISO 27001, NIST CSF), update governance and technical controls. 

• Monitor regulatory developments: the Bill puts much detail into secondary legislation and codes of practice we will provide further blogs as more details are established. 

Even if your organisation is not currently formally captured, the signal is that cyber-resilience is moving swiftly from “good practice” to legal obligation for more and more organisations. 

Final thoughts

In an era when digital services underpin everyday life, from turning on lights, booking hospital appointments, to recharging an electric vehicle, the UK is raising the regulatory bar. The Cyber Security and Resilience (Network and Information Systems) Bill represents a major change to how cyber risk is regulated: broader coverage and stronger enforcement. 

For those leading cyber, resilience, risk or operations, this isn’t just “another regulation”, this should be a framework that can be leaned on to increase your organisation’s resilience to emerging cyber risks.  

Cybersecurity support

With deep experience across the sectors in scope data centres, RDSPs, RMSPs, OES and CNI and a breadth of experience in existing regulatory frameworks, including NIS (2018), NCSC’s CAF, NIS2 Directive, GDPR, DORA, etc, Evalian can support your business from gap analysis through framework development to implementation.

Evalian is well placed to help you get ahead of the curve and embed a cyber-resilient foundation for the future.