The New 2025 Cyber Security and Resilience Bill

Why Did The UK Introduce the Cyber Security and Resilience Bill? 

In June 2024, the NHS was hit by a devastating ransomware attack that resulted in over 10,000 outpatient appointments being cancelled. It was a stark reminder that even critical national infrastructure is vulnerable, even with all the expertise and resources that goes in to managing it. Across the UK, organisations large and small are facing increasingly sophisticated cyber threats, many of which exploit weaknesses in supply chains or under-regulated digital service providers. 

Recognising that the Network and Information Systems (NIS) Regulations 2018 were no longer sufficient, the UK Government responded with proposing a new set of legislation, the Cyber Security and Resilience Bill. First announced in 2024 and expected to transfer formally into UK law in 2025, this legislation is designed to enhance national cyber resilience and modernise regulatory powers to keep pace with rapidly evolving cyber threats. 

Core Principles of the Cyber Security and Resilience Bill

The Cyber Security and Resilience Bill represents a major overhaul of the UK’s cyber security legislation, aiming to strengthen protections for critical services and digital supply chains in an era of escalating cyber threats.

The Cyber Security and Resilience Bill establishes a framework for improving national cyber resilience by imposing clearer, enforceable obligations on operators of essential services and critical digital suppliers. Its core principles include:

• Accountability and Governance: Drawing on from principles established by the EU GDPR (General Data Protection Regulation), cyber security must be treated as an organisational governance issue, with responsibility sitting at senior executive and board levels.

• Expansion of In-Scope Entities: The Cyber Security and Resilience Bill now applies not only to traditional critical national infrastructure (CNI) sectors but also to managed service providers (MSPs), cloud services, data centres, and other digital enablers (more on the scope of this definition later).
• Mandatory Cyber Risk Management: Organisations must implement and maintain proportionate, risk-based cyber security measures to protect essential services.
• Mandatory Incident Reporting: Significant cyber incidents must be reported to the relevant authorities within 72 hours.
• Strengthened Regulatory Powers: Under the new Cyber Security and Resilience Bill, authorities such as Ofcom, the ICO, and DSIT have the legal power to audit, investigate and enforce compliance through improvement notices and financial penalties.
• Supply Chain Security: Businesses must actively mitigate cyber risks posed by their suppliers and business partners.
• Sector-Specific Codes of Practice: Industry-specific guidance will be developed to help organisations interpret and meet their obligations.

When Does The New Law Come Into Effect?

The Cyber Security and Resilience Bill is expected to complete its passage through Parliament and receive Royal Assent by Q4 2025. However, as ever with legislation of this type, the government has indicated that implementation will be gradual:

• Royal Assent: On track for Q4 2025.
• Transitional Guidance Issued: Expected Q1 2026, providing organisations with detailed instructions on how to comply.
• Phased Enforcement Period: Active enforcement of the new obligations under the Cyber Security and Resilience Bill will begin gradually through 2026, allowing time for organisations to adapt.

Organisations are strongly encouraged to begin preparations now, particularly those operating essential services or supplying critical digital services, as compliance requirements will not be retroactive but are expected to be enforced rigorously once the transitional period ends.

Early adoption of best practices (such as alignment with ISO 27001, Cyber Essentials Plus, etc.) will be key to avoiding penalties when the Cyber Security and Resilience Bill comes into effect.

The Cyber Security and Resilience Bill vs. The NIS Regulations

While the Cyber Security and Resilience Bill builds on the foundation laid by the Network and Information Systems (NIS) Regulations 2018, it introduces several critical enhancements and differences:

• Broader Scope: Unlike NIS, which focused mainly on traditional critical sectors, the Cyber Security and Resilience Bill brings a wider range of digital service providers into scope, reflecting the increasing reliance on digital infrastructure.
• Risk-Based Approach: The Cyber Security and Resilience Bill adopts a proportionate, risk-based framework rather than a one-size-fits-all model, allowing different requirements based on an organisation’s size, influence and risk profile.
• Proactive Regulatory Powers: Regulators can now conduct proactive audits and interventions, whereas NIS was predominantly reactive, acting after incidents occurred.
• Clearer Supply Chain Duties: NIS did not directly regulate supply chains. The Cyber Security and Resilience Bill imposes quite a specific focus on third party risk management and securing supply chain dependencies.
• Alignment with International Standards: The Cyber Security and Resilience Bill explicitly acknowledges frameworks like ISO 27001, NIST CSF and the EU’s NIS2 Directive to promote international consistency.
• Stronger Penalties: The Cyber Security and Resilience Bill provides for significantly higher financial penalties for non-compliance, with fines up to £17 million or 10% of global turnover. Under the original NIS Regulations, the maximum fine was £17 million per incident, with no reference to a percentage of global turnover. It was a fixed ceiling — it didn’t scale based on the size of the company.

Legislation	Maximum Fine	Based on Turnover	Applicability
Cyber Security and Resilience Bill	£17 million or 10% of global turnover (whichever is higher)	Yes	Proportionate to company scale and global operations
NIS Regulations 2018	£17 million	No	Fixed ceiling regardless of company size
GDPR (General Data Protection Regulation)	€20 million (£17.2 million) or 4% of global annual turnover (whichever is higher)	Yes	Proportionate and designed to ensure meaningful enforcement

Together, these changes move the UK’s cyber security framework from a relatively narrow, prescriptive approach under NIS to a broader, more dynamic and proactive national resilience strategy.

Who Has to Comply With This New Regulation? 

One of the most important questions businesses are asking is whether they fall within the scope of the Cyber Security and Resilience Bill. While the Bill casts a wider net than the NIS Regulations (2018), it doesn’t apply to all UK organisations and there are some exceptions which might get you off the hook!

Here’s how to determine if you’re in or out of scope of the Cyber Security and Resilience Bill: 

🎯 You Are IN SCOPE If…

1. You provide essential or important services in sectors such as energy, transport, healthcare, drinking water, digital infrastructure, or financial services.

The definition of “essential or important services” are “…those which, if disrupted, would have a significant impact on the economy, society, public health, public safety, or national security.”

Specifically, they include sectors such as:

• Energy (e.g., electricity, gas, oil)
• Water (drinking water supply and distribution)
• Transport (air, rail, maritime, road transport)
• Health (NHS services, hospitals, labs)
• Digital Infrastructure (internet exchange points, DNS service providers)
• Financial Services (banks, stock exchanges, payment systems)
• Public Administration (government agencies delivering public services)

“Important services” under the updated framework also extend to:

• Managed Service Providers (MSPs)
• Cloud computing services
• Data centre operations
• Online marketplaces
• Search engines and social networks
• Trust service providers (like those issuing electronic certificates)

2. You are a  Managed Service Provider (MSP) or  Managed Security Service Provider (MSSP) supporting critical national infrastructure.

Under the Cyber Security and Resilience Bill a “Managed Service Provider (MSP)” is considered any company “…that remotely manage or support the IT services, networks, systems, or infrastructure of other organisations — especially in ways that, if compromised, could seriously disrupt the client’s operations or expose sensitive data.”

Specifically, an MSP typically provides:

• Remote administration of servers, networks, or end-user systems.
• Cyber security monitoring, threat detection, and incident response.
• Cloud hosting or cloud management services.
• Backup, disaster recovery, or business continuity support.
• Identity and access management.
• Patch management and system updates.

3. You deliver digital services (e.g. online marketplaces, cloud computing, search engines) with a significant user base. 

‘Digital Services’ refers to “…businesses that provide core digital infrastructure or platforms essential for modern commerce, communication, and society”.

Specifically, the Cyber Security and Resilience Bill defines digital services as:

• Online Marketplaces Platforms that allow consumers and/or businesses to buy and sell goods or services online (e.g. Amazon Marketplace, eBay, Etsy).
• Online Search Engines Services that allow users to search for information across the internet (e.g. Google Search, Bing).
• Cloud Computing Services Providers offering services such as:
  • Infrastructure as a Service (IaaS)
  • Platform as a Service (PaaS)
  • Software as a Service (SaaS) Examples: AWS, Microsoft Azure, Google Cloud, Salesforce.
• Data Centres and Hosting Providers Facilities and companies responsible for storing, processing, and managing data on behalf of businesses.
• Content Delivery Networks (CDNs) Systems that help distribute web content rapidly across global locations (e.g. Akamai, Cloudflare, etc.).

4. You operate in the supply chain of essential service providers, particularly if your service is critical to their function.

What does this mean? If your company supplies products, technology, or services that an essential organisation (like the NHS, a water company, or a bank) depends on to keep running, you could fall under the new law.

Even if you’re not delivering the essential service directly, if your failure would disrupt their ability to operate, you’re considered part of their critical supply chain. Examples include (but not limited to):

1. You process or store large volumes of personal or sensitive data as part of your business model.
2. Your organisation’s disruption would pose a risk to an essential service provider’s ability to continue operating.
3. Your organisation’s disruption would pose a direct risk to the public, the economy, or national security.

💨 You Are OUT OF SCOPE If…

1. You are a micro or small business (typically fewer than 50 employees and under £10 million turnover) and have minimal digital exposure or reliance.
2. You do not provide IT or digital services, nor are you involved in high-risk data handling or supply chains.
3. Your organisation operates entirely outside of the UK or does not serve UK-based customers or critical service providers. 

Important Caveats:

• Size thresholds alone may not exempt you. If your services support or underpin a larger in-scope entity, you will still be required to comply with the Cyber Security and Resilience Bill. 
• The government may revise scope criteria based on sector-specific risk assessments. 
• Many private sector organisations not directly in scope will still need to adhere to higher cyber security standards due to client or investor expectations.

“Due to the distributed supply chain nature of The Cyber Security and Resilience Bill we expect to see a general uplift in adherence to cyber security standards such as ISO 27001, SOC 2 and Cyber Essentials Plus as businesses expect more from their suppliers for their own compliance, whether those suppliers are in-scope or not.” – Rob McBride, CyPro Partner.

For the most detailed interpretation, consult the UK Government’s consultation outcome and the latest NCSC sectoral guidance. 

If you’re unsure whether you are in-scope or not, speak to a CyPro partner today or read further on the official word-for-word Cyber Security and Resilience Bill definitions.

Enforcement & Penalties

The Cyber Security and Resilience Bill introduces tangible compliance obligations for in-scope UK businesses. The costs both financial, operational and reputational, could be significant if organisations fail to respond in time.

“Businesses that view cyber resilience as a compliance tick-box exercise will eventually be tied up in red tape, get priced out of markets, penalised by their insurer and lose trust with customers.” — Jonny Pelter, CyPro – 2025

While the Cyber Security and Resilience Bill in 2025 sets a progressive tone for improving national cyber defence, many UK businesses are still unclear about what happens if they fail to comply. Understanding enforcement mechanisms and penalties is crucial for effective cyber risk management and governance.

📋 Who Will Enforce the Bill?

The primary enforcement authority is expected to be the Department for Science, Innovation and Technology (DSIT), working alongside the National Cyber Security Centre (NCSC). Regulators will have enhanced powers to:

• Conduct audits and inspections
• Request evidence of risk assessments, incident response plans, and supply chain assurances
• Impose formal improvement notices on non-compliant entities

Additional oversight may come from sector-specific regulators such as Ofcom, Ofgem, or the ICO, depending on the industry.

💣 What Are the Penalties?

The Bill is expected to mirror and extend the penalty structure of the existing Network and Information Systems (NIS) regulations, meaning penalties could be significant, especially for operators of essential and digital services. While final figures are pending legislative approval, proposed enforcement actions include:

• Financial Penalties: Fines of up to £17 million or 10% of global turnover, whichever is higher. This scaling model mirrors GDPR enforcement, ensuring that penalties for large corporations are proportionate to their size and influence.
• Daily penalties for ongoing non-compliance against the cyber security and resilience bill
• Regulatory Enforcement Notices: Regulators such as Ofcom or the ICO will have the power to issue legally binding ‘improvement notices’. Failure to comply with these could result in daily accumulating fines and public sanctioning.

These measures are designed not only to punish lapses, but to incentivise proactive investment in cyber resilience.

In addition to these regulatory actions, failure to comply can lead to other severe consequences:

• Public Naming and Shaming: Organisations that suffer breaches due to poor cyber security practices, risk being publicly identified by regulators, severely damaging brand reputation and customer trust. As observed in GDPR cases, research has found public breach announcements often have more lasting damage than the fines themselves.
• Insurance Implications: Non-compliance can lead to higher general business and cyber security insurance premiums, or even denial of coverage in its entirety. Insurers are increasingly requiring proof of regulatory compliance as a condition of underwriting cyber policies (Marsh Cyber Insurance Trends Report 2024).
• Increased Cost of Financing: Investors are placing greater emphasis on cyber security due diligence. Firms that fail to demonstrate compliance with cyber resilience standards risk significantly reduced valuations during funding rounds or mergers and acquisitions (McKinsey & Company – The New Imperative for Cyber Resilience).

• Contractual Risks: Essential service providers and regulated industries will increasingly mandate cyber security compliance for suppliers. Failure to comply could result in your organisation being taken to court over non-compliance with new contractual terms once the Cyber Security and Resilience Bill has come into effect.
• Direct Loss of Revenue: Non-compliant businesses will inevitably lose some of their larger contracts or find themselves excluded from critical supply chains or procurement frameworks.

🛡️ What Triggers Enforcement?

Key triggers for regulatory action against the cyber security and resilience bill will include:

• Failure to implement “appropriate and proportionate” technical and organisational measures
• Delayed or incomplete reporting of significant cyber incidents
• Lack of accountability or traceability in supply chain risk management
• Inadequate incident response capability

“Organisations need to understand that cyber security isn’t just a technical issue — it’s an operational and reputational one. Regulatory non-compliance will directly hit balance sheets and boardrooms.” — Jonathon Ellison, Director of Resilience and Future Tech, NCSC

Recent Changes to the Bill

The evolution of the Cyber Security and Resilience Bill has involved several key milestones, informed by public consultation, parliamentary debate, and industry feedback. Below is a chronological breakdown of the most significant events and legislative developments:

📅 16 January 2025 – Introduction of the Bill in Parliament

The UK Government formally introduced the Cyber Security and Resilience Bill to Parliament. The Bill proposes to amend and expand the NIS Regulations 2018, extending the scope to more sectors, enhancing enforcement, and creating a more flexible, risk-based approach.

📅 22 February 2025 – Government Issues Policy Statement

The Department for Science, Innovation and Technology (DSIT) released a comprehensive policy statement confirming the proposed structure of the new regulatory framework. This included a commitment to:

• Strengthen duties for critical national infrastructure (CNI) operators,
• Introduce proportionate enforcement via graduated penalties,
• Develop sector-specific codes of practice,
• Apply security obligations to managed service providers and digital service suppliers.

📅 March 2025 – Expanded Regulatory Scope Confirmed

DSIT confirmed that a wider class of digital service providers — including cloud computing, online marketplaces, and data centres — will fall under the Bill. MSPs and third-party vendors supporting essential services are explicitly named as regulated entities.

📅 April 2025 – Ministerial and NCSC Endorsement

Feryal Clark MP, Parliamentary Under-Secretary for AI and Digital Government, publicly endorsed the Bill, calling cyber security an “essential pillar of economic growth.” Richard Horne, CEO of the NCSC, described it as a “landmark moment” for UK cyber policy.

📅 Expected Q4 2025 – Royal Assent Anticipated

Following parliamentary readings and scrutiny, the Bill is expected to pass into law by the end of 2025. Regulatory bodies will then issue final guidance and begin phasing in enforcement.

For further details, refer to Bird & Bird’s legal commentary and Industrial Cyber’s policy breakdown.

Additional Insights from Industry Analysis

🚨 Expanded Role of the Secretary of State

Recent commentary has highlighted the increased influence of the Secretary of State for Science, Innovation and Technology, who will have delegated authority to define new sectors and entities considered essential. This gives DSIT (Department for Science, Innovation and Technology) broader powers to adjust the scope of the Cyber Security and Resilience Bill over time, in response to emerging cyber threats. 

👩🏽‍💼 Clarification of MSP Obligations

According to industry analysis from techUK, Managed Service Providers (MSPs) and cloud service vendors will need to maintain detailed records of their security posture and demonstrate proactive incident management. This reflects government concerns about concentration risk in critical IT outsourcing. 

⚖️ Importance of Proportionality in Enforcement

The Cyber Security and Resilience Bill includes new language around proportionality, meaning that enforcement measures and compliance obligations will be adapted depending on the size and nature of the organisation. This is crucial for small and medium businesses that may otherwise struggle to meet the same standards as large enterprises. 

🛜 Expanded Role of the ICO for Digital Service Providers

Digital service providers, such as search engines, cloud platforms, and marketplaces, will fall under ICO supervision rather than traditional infrastructure regulators. The ICO will issue tailored guidance to help these platforms prepare. 

⏰ Early Indications of Timelines

As discussed by Covington’s Inside Privacy, while the Cyber Security and Resilience Bill is expected to be passed into law in late 2025, implementation is likely to be phased. Organisations should anticipate transitional guidance in the second half of 2025 and full enforcement in 2026. 

For a detailed breakdown of sector-by-sector guidance and implementation forecasts, refer to Business Reporter’s explainer. 

How the UK’s Approach Compares Globally 

NIS2 Directive (EU)

The UK Bill closely mirrors the EU’s NIS2 Directive, particularly in its: 

• Expanded scope, 
• Risk-based approach,
• Tiered obligations based on business size and impact. 

However, the UK retains regulatory flexibility by assigning oversight to domestic bodies rather than an EU-wide framework. 

International Comparisons

Globally, similar legislation includes: 

• CIRCIA (USA) which mandates incident reporting for critical infrastructure, 
• Security of Critical Infrastructure Act (Australia), 
• Bill C-26 (Canada) with a strong emphasis on telecom and energy sectors. 

This 2025 Cyber Security and Resilience Bill starts to position the UK as a leader in harmonising cyber resilience with global best practice. 

4 Practical Steps to Become Compliant

Below contains four practical compliance steps for SMEs to help you get compliant with the new Cyber Security and Resilience Bill.

1. Seek Expert Advice on Scope (For Free!)

Don’t struggle on your own. What’s more, don’t fall into one of two common pitfalls!

❌ Don’t incorrectly determine you are out of scope, only find out later from a regulator that you are indeed in-scope and now have a hefty fine to pay.
❌ Don’t incorrectly assess yourselves as in scope and waste significant resources and time becoming compliant to a regulation which you actually don’t need to be!

Ensure you start off on the right foot, book time with a CyPro partner at a time convenient for you and have an exploratory discussion to determine how the Cyber Security and Resilience Bill might affect you.

2. Compliance Risk Assessment

Start with a structured evaluation of your current security posture and where your potential gaps in compliance are against the upcoming Cyber Security and Resilience Bill. Engage a cyber security specialist to provide an impartial cyber risk assessment and recommendations.

3. Remediation Roadmap & Business Case

In collaboration with your chosen cyber security partner, collate and structure all the recommendations and actions from your compliance risk assessment into a deliverable cyber roadmap. Define all of the following:

⚙️ Define Work packages (‘projects’) with detailed scopes of work, specific deliverables and defined milestones which implement the controls and capabilities you are missing to meet compliance
📆 Design a Roadmap – structure these work packages into a program of work that can be delivered over time (i.e. with the right sequencing based off project inter-dependencies)
🧑🏻‍💼 Delivery Model – define the best delivery mechanism for your organisation (business-as-usual vs. change program vs. hybrid) – do you have all the required skills in-house? Do you need external support? Do you have the internal capacity to take on this remediation work right now?
💷 Resourcing Estimates – evaluate the level of resourcing, expertise and finances (CAPEX and OPEX) required to deliver the roadmap

Condense and summarise all of the above into a business case that you can then take your senior management for approval.

📝 Example: Map Your Supply Chain 

Your remediation plan (‘roadmap’) will contain a fair amount of different remediation work and will vary depending on the level of investment to date in cyber security and your current maturity in this space.

An example of the types of work you’ll be likely needed to do would be around mapping your existing supply chain. Once of the biggest and most challenging requirements is to understand your supply chain and its dependencies (both your role in other’s supply chains, and your own network of vendors and third parties). Compile an inventory of all third-party services, vendors, and partners that access your systems or data. Then: 

• Create a supplier risk management framework to categorise and evaluate your suppliers
• Discover all your third parties (harder than you think!)
• Classify them into risk tiers, determining which are considered ‘critical’
• Perform vendor risk assessments
• Map cyber security controls to your supplier risk categorisation matrix (i.e. which categories of suppliers will need which types of control in place)
• Mandate security clauses in contracts (e.g. right to audit, encryption standards, data breach notification windows)
• Establish third party monitoring to ensure your suppliers are adhering to their contractual obligations

4. Align to ISO 27001 or Cyber Essentials Plus 

The Cyber Security and Resilience Bill explicitly calls out the need to comply with certifications like ISO 27001 and Cyber Essentials Plus in order to reach compliance with the new legislation. These certifications not only enhance security but also provide significant business value such as: 

• Streamline onboarding with enterprise clients 
• Help you get software products to market faster
• Help reduce business insurance premiums 
• Demonstrate governance maturity to sales prospects

Check out our client stories page for more case studies.

4 Ways To Get Started

1. Do It Yourself

If you have the time, capacity, resources, funding and expertise all in-house then the best option might be to do it all in-house.

⚠️ Be aware that the entire ‘delivery risk’ sits with yourselves, you will likely be short on regulatory experts and capacity might get stretched impacting day-to-day business operations.

2. Individual Contractor

You could always engage an individual contractor on a day rate basis. They would bring more cyber security expertise (and 1FTE of capacity) to the table than what you likely have in-house. However, be aware they will be limited to their own knowledge and experience, given this is a new piece of legislation this could prove to be a high-risk strategy. Also, given they will be working on a day rate basis they will not be incentivised to finish quickly which may result in wasted funding or resources.

3. Virtual CISO

If all this sounds quite daunting, let a vCISO do it for you. A virtual CISO offers expert cyber security leadership without the full-time costs. Their role encompasses: 

• Strategy development
• Stakeholder engagement
• Policy design
• Cyber risk tracking
• Oversight of technical control implementation

A virtual CISO will be able to help you determine whether your organisation falls in or out of scope, how to close your compliance gaps and provide ad hoc advice and guidance along your journey. You will however need to do the remediation work yourself.

With a strong vCISO provider you will also get access to a team of technical cyber experts who should include regulatory and resilience subject matter experts who will help de-risk your journey to attaining compliance with the Cyber Security and Resilience Bill.

4. Cyber-as-a-Service

Want someone to just take this off your hands? Consider a more end-to-end service such as Cyber-as-a-Service which will take care of all your compliance obligations on your behalf.

Cyber Security as a Service (CSaaS) offers you advanced cyber services on a subscription basis, at a fraction of the cost of an in-house team. It includes services like vCISO, pen testing, security monitoring and staff training. 

CyPro’s Cyber-as-a-Service guarantee’s you comply with the new Cyber Security and Resilience Bill in time.

Conclusion

The Cyber Security and Resilience Bill is not just another compliance checklist. It represents a cultural shift in how the UK defends its digital economy. Organisations must act now to: 

• Understand their obligations
• Reduce cyber risk
• Position themselves as trusted, secure partners in a rapidly evolving landscape

To explore how your business can align with the Cyber Security and Resilience Bill, speak to a cyber security expert today or visit the UK Government consultation page. 

Staying ahead isn’t just a legal imperative, if used correctly, it can be competitive advantage.