The UK’s new Cyber Security and Resilience Bill represents the UK’s most significant overhaul of cyber legislation in over a decade, with direct implications for our specialist partners and public sector customers. Introduced to Parliament in November, the Bill is expected to receive Royal Assent by the middle of the year, and then be rolled out in stages throughout 2026 and 2027.
What does the Bill cover?
The Bill includes a number of measures that will have an impact on suppliers and buyers of digital services.
-
24-hour incident reporting requirement: Organizations must report significant cyber incidents within 24 hours of discovery, followed by a full report within 72 hours, with the threshold capturing incidents capable of significant impact, not just those that are known to have caused disruption.
-
Expanded regulatory scope: The Bill extends coverage to previously unregulated entities including Managed Service Providers (MSPs), cloud platforms, data centres, and critical suppliers that support essential services – this is likely to affect many of our partners.
-
Severe financial penalties: Regulators can impose fines up to £17 million or 10% of global turnover (whichever is higher) for non-compliance, with daily penalties of up to £100,000 for continuing violations. These fines could face an existential threat to non-compliant SMEs in particular.
-
Designated Critical Suppliers framework: Digital suppliers whose disruption could significantly impact essential services can be formally designated, requiring them to meet the same stringent cybersecurity obligations as public sector organisations themselves.
-
Emergency intervention powers: The Technology Secretary will gain new powers to issue legally binding directions requiring immediate action from regulated entities where national security risks are identified.
Additionally, the Technology Secretary receives powers to update the regulations in future without requiring further changes to the law.
Impact on public sector customers
Public sector organisations face significantly expanded obligations under the new legislation. Local authorities, councils, NHS trusts, and central government departments are explicitly designated as essential services that must comply with enhanced cyber security requirements. These organisations will be required to report significant cyber incidents within 24 hours of discovery, followed by a comprehensive report within 72 hours.
Public sector bodies must conduct regular cyber risk assessments, implement robust incident response plans, and ensure their cybersecurity policies align with the Bill’s stricter standards. Board-level engagement is essential, with senior leadership required to understand cybersecurity risks and maintain clear reporting lines for security incidents.
Impact on digital services suppliers
The Bill dramatically extends regulatory scope to include Managed Service Providers (MSPs), cloud platforms, data centres, and critical suppliers that were previously unregulated. Digital suppliers supporting public sector organisations may be designated as “Designated Critical Suppliers” (DCS) if their disruption could significantly impact essential services.
Once designated, suppliers face the same stringent obligations as public sector organisations themselves. They must meet statutory cyber security requirements, manage and reduce risks through evidence-based measures, and submit to regulatory inspections. Suppliers will need to demonstrate security-by-design principles, maintain technical documentation, and ensure their own supply chains meet compliance standards.
For businesses providing technology, cloud services, or managed services to the public sector, supply chain vetting becomes critical. Organisations should assess the cybersecurity readiness of their own third-party suppliers and establish contract clauses that enforce compliance with best practices.
How to prepare
For public sector procurement professionals and their technology partners, early preparation is essential. Key recommendations include:
-
Appoint a compliance lead: Designate a Cyber Risk Officer or compliance leader with direct access to senior leadership to oversee cybersecurity initiatives and ensure alignment with the Bill
-
Conduct gap analysis: Map your current cybersecurity posture against the Bill’s requirements using frameworks like the NCSC’s Cyber Assessment Framework (CAF) to identify vulnerabilities
-
Develop incident response protocols: Create detailed plans covering detection, mitigation, reporting, and recovery that enable 24-hour incident notification
-
Update compliance policies: Align internal policies with stricter incident reporting standards and ensure processes support quick reporting and recovery
-
Vet supply chain partners: Assess third-party suppliers’ cybersecurity readiness and establish contractual requirements for compliance
-
Secure board-level buy-in: Educate senior executives on their responsibilities and establish cybersecurity as a recurring board agenda item
Early compliance can be seen as an opportunity rather than just as an overhead. Organisations that proactively align with the Bill’s requirements will not only avoid penalties and reduce cyber risk but also strengthen their competitive position as compliance becomes a key selection criterion for contract awards.
