Overview of the UK Cyber Security and Resilience (Network and Information Systems) Bill
The UK Cyber Security and Resilience (Network and Information Systems) Bill, introduced in July 2024, represents a significant reform of the existing Network and Information Security Regulations 2018 (UK NIS). This legislation aims to modernize cybersecurity measures to address evolving threats, particularly those targeting critical national infrastructure (CNI) and essential digital services. The Bill was first read in Parliament on November 12, 2025, and underwent a second reading in January 2026, with ongoing committee stage reviews inviting expert feedback. As of May 2026, the Bill remains under legislative process, with Royal Assent expected late in the year.
The reform aligns the UK’s cybersecurity framework with the European Union’s NIS2 Directive (2022/2555), expanding regulatory scope to include data centers and managed service providers (MSPs) hosting AI workloads.
The Bill’s development follows high-profile cyber incidents, such as the 2024 ransomware attack on NHS hospitals in South London, which disrupted 3,396 outpatient appointments and 1,255 elective procedures. The estimated cost of cybercrime in the UK reached £225 billion in 2023, underscoring the economic and operational risks posed by inadequate cybersecurity measures. The National Cyber Security Centre (NCSC) has repeatedly warned that providers of essential services cannot afford to overlook these escalating threats.
Key Objectives and Scope of the Bill
The primary objective of the Cyber Security and Resilience Bill is to strengthen the UK’s cyber defenses by introducing a comprehensive regulatory framework. This framework will enforce mandatory compliance with cybersecurity standards across sectors, including transport, energy, drinking water, health, and digital infrastructure. The Bill also extends coverage to digital services such as online marketplaces, search engines, and cloud computing, aligning with the broader EU NIS2 Directive.
One of the Bill’s critical innovations is the expansion of regulatory oversight to include data centers and managed service providers (MSPs) that host AI workloads. The Bill aims to ensure that these entities adhere to stringent cybersecurity practices, reducing the likelihood of successful cyber attacks.
The legislation introduces compulsory ransomware reporting requirements, mandating that regulated entities disclose incidents to authorities. This measure is designed to improve threat intelligence and enable proactive responses to emerging cyber risks. However, the administrative burden of these reporting requirements may impose additional costs on businesses, alongside the financial impact of cyber incidents themselves.
The Bill also proposes cost recovery mechanisms to fund regulatory activities and enhance the powers of regulators. This includes the ability to proactively investigate potential vulnerabilities in systems, ensuring that cybersecurity measures remain adaptive to new threats. The Information Commissioner’s Office (ICO) will play a key role in gathering data and enforcing compliance, with the government reserving the right to update regulatory frameworks as technology and threat landscapes evolve.
Regulatory Framework and Compliance Requirements
The Cyber Security and Resilience Bill introduces several measures to enhance the regulatory framework governing cybersecurity in the UK. These include mandatory risk assessments for approximately 1,000 organizations, with a focus on improving data protection and network security. The Bill also updates the Cyber Essentials program, a government-backed scheme designed to help organizations implement basic cybersecurity controls. Changes to the program include revised software definitions, updated vulnerability fixes, and clearer terminology related to remote working.
Organizations will be required to demonstrate compliance through regular audits and incident reporting. The Bill does not yet specify penalties for non-compliance, though it has been announced that fines of up to £100,000 per day may be imposed for failing to address relevant cyber threats.
The Bill’s scope extends beyond direct regulatory targets to include supply chain partners and third-party service providers. Organizations must ensure that their vendors and suppliers also comply with the cybersecurity standards set by the Bill, recognizing that interconnected modern business practices amplify risks if any single link in the chain is vulnerable.
The adaptability of the regulatory framework is a key feature of the Bill. Given the rapid pace of technological change, the government reserves the authority to update the regulatory requirements as necessary. This flexibility ensures that the framework remains effective against emerging threats, such as those posed by AI-driven cyber attacks or new forms of state-sponsored espionage.
Challenges and Industry Reactions
While the Bill has been widely welcomed by cybersecurity experts, including the NCSC and former heads of the organization, concerns remain about its implementation. The CyberUp Campaign has expressed support for the Bill but has also called for updates to the Computer Misuse Act 1990 to better equip cyber professionals with the tools needed to protect the UK’s digital economy.
The NCSC has described the Bill as a landmark step in addressing the growing threat to the UK’s critical systems. Director of National Resilience Jon Ellison emphasized that the legislation is a crucial component of a more comprehensive regulatory regime, one that is necessary to counter the volatile cyber threat landscape. Former NCSC head Ciaran Martin and other experts have praised the mandatory reporting requirements as a significant positive development, though they have also highlighted the need for clear enforcement mechanisms.
Organizations will need to invest in cybersecurity infrastructure and training to meet the new standards, while regulators must ensure that the framework remains proportionate and effective. The Bill’s success will depend on its ability to foster a culture of cyber resilience across all sectors of the UK economy.
Required actions
- Would bring managed service providers, data centres and more digital services into the NIS regime - Would require 24-hour initial and 72-hour full incident reports and give regulators cost-recovery and stronger enforcement powers