The Cyber Security and Resilience Bill has been steadily working its way through Parliament since it was introduced in November 2025, and as of this year it has cleared the Commons and moved to the House of Lords. It’s the biggest update to UK cyber law since the original NIS Regulations in 2018 – and while it’s aimed squarely at larger organisations, the effects reach a lot further down the supply chain than most SMEs realise.

What the Bill actually does

• Brings managed service providers under direct regulatory oversight for the first time – an estimated 900–1,100 MSPs in the UK will fall into scope.
• Introduces a much tighter incident reporting timeline: an initial notification within 24 hours of a significant incident, followed by a full report within 72 hours.
• Extends security duties from “keeping services running” to actively managing risk across an organisation’s supply chain.
• Gives regulators stronger enforcement powers, with fines for in-scope organisations reaching up to £17 million or 4% of global turnover for the most serious breaches.

Why this matters if you’re not directly in scope

Most small and medium businesses won’t be regulated directly under this Bill. But if you supply goods or services to a larger organisation – or if your IT provider is one of the MSPs brought into scope – the requirements cascade down through contracts. Expect more cyber security clauses in supplier agreements, more assurance questionnaires, and Cyber Essentials certification shifting from “nice to have” to a routine condition of doing business with bigger clients.

The government has been clear that the expectation on smaller businesses is proportionate, not enterprise-grade: understand your risks, take reasonable steps, and be able to show evidence of both. Cyber Essentials, maintained access controls, regular patching, and a tested incident response plan cover most of that ground.

What to do before it lands

Royal Assent is expected later in 2026, though phased implementation means the full requirements may not bite until 2028. That’s a reasonable runway – but the direction of travel is already showing up in client contracts now, so there’s no real benefit to waiting. A Cyber Essentials review is the natural starting point if you haven’t got one in place.