UK Cyber Security & Resilience Bill — the verified record, live

The Cyber Security and Resilience Bill is the UK's answer to the widening gap between its inherited cyber framework — the NIS Regulations 2018 — and the threat environment that has produced disruptive attacks on health services, supply chains and major retailers. Announced in the July 2024 King's Speech and shaped by a government policy statement in April 2025, the Bill is designed to expand regulation to more of the digital economy, bringing managed service providers into scope and addressing critical suppliers and data infrastructure, while strengthening regulators' powers, modernising incident reporting with tighter timelines, and enabling faster updating of the framework as risks evolve. Enforcement would remain with existing sectoral competent authorities, including the ICO for digital services, on a cost-recovery-strengthened footing. As a Bill in passage rather than settled law, the operative detail — final scope, reporting thresholds, penalty levels and commencement — depends on the text as enacted and subsequent secondary legislation, which is precisely why organisations in and near scope are tracking it closely now.

Every document below comes from the body that published it — regulators, courts, parliaments, official registers — with its true publication date and a link to the primary source.

as of 2026-08-31 · refreshed from scheduled releases

Latest developments

Publishing bodies represented

Frequently asked

Who will the Cyber Security and Resilience Bill apply to?

It builds on the NIS Regulations 2018, which cover operators of essential services in sectors such as energy, transport, water, health and digital infrastructure, plus certain digital service providers. The government has confirmed the Bill will extend scope to managed service providers and create mechanisms to address critical suppliers, with data centres also within the framework's ambit; precise boundaries depend on the final text and secondary legislation.

Who will enforce the new regime?

The existing model of sectoral competent authorities is expected to continue: regulators such as Ofcom, Ofgem and the health and transport authorities for their sectors, and the Information Commissioner's Office for relevant digital services, with the National Cyber Security Centre providing technical support rather than acting as a regulator. The Bill is intended to strengthen these regulators' information, enforcement and cost recovery powers.

How does the Bill change incident reporting?

The stated intention is a broader and faster reporting regime: notification of a wider range of significant incidents, including some that do not interrupt service, with an initial report expected within around 24 hours and a fuller report within 72 hours, and reporting to both the regulator and the NCSC. Exact triggers and timelines will be fixed in the enacted legislation and accompanying regulations.

More: The Wire — this week across the record · all 38 ecosystems · analyst briefs on this regulation ↗