Cyber Security and Resilience Bill: what it means if you use an IT provider

If a company looks after your computers, email, backups or help desk, the Cyber Security and Resilience Bill is worth a few minutes of your time. It is a UK Bill, not yet law, and it does not regulate small businesses directly. But it does change what many IT support companies will have to do, and that can affect you as their customer.

What the Bill is and where it has got to

The government says the Bill will "reform and add to" the existing Network and Information Systems (NIS) Regulations 2018, with the aim of increasing UK defences against cyber attacks and protecting essential public services. It was introduced to Parliament on 12 November 2025, and GOV.UK's collection page says it has completed its second reading and committee stage in the House of Commons.

It is not law yet. The government's own factsheets say the main measures for managed service providers take effect through secondary legislation after Royal Assent, so the detail is still to come. Treat this as an early warning, not a deadline.

Why IT providers are in the spotlight

The government describes the problem as "one to many". A single managed service provider (MSP) may have remote access to the systems of dozens or hundreds of customers. If an attacker gets into that provider, they may reach all of its customers at once. The Bill is designed to put a legal floor under the security of those providers.

Government research from 2025 counted 12,867 active MSPs in the UK, employing 343,762 people. It estimated that about 1,214 of them could be in scope of the Bill, depending on the definitions used. So most providers will not be covered, and the ones that are will be the larger ones.

Who counts as a "relevant managed service provider"

Under the factsheet, a relevant managed service provider is a business that provides managed services in the UK and is not a small or micro enterprise. "Managed services" means a service under a contract for ongoing management of IT systems for the customer, where the provider connects to or accesses the customer's networks and systems. Examples given include IT outsourcing, remote support or helpdesks, and managed security services.

The factsheet is equally clear about what is outside the definition:

• Small and micro enterprises (though they can still be designated as critical suppliers, see below).
• Consultancies such as tax, accountancy and legal firms.
• Firms that install systems without ongoing management.
• Software vendors that sell products, including ad hoc remote patches.

The regulator for these providers would be the Information Commission (formerly the Information Commissioner's Office).

What covered providers will have to do

According to the factsheets, a covered provider must:

• Register with the Information Commission, within three months of the rules starting.
• Take appropriate and proportionate measures to manage risks to the networks and systems used to provide the service, with security matched to the level of risk and the "state of the art".
• Notify the regulator of significant incidents.

The incident rules matter most to you as a customer. The incident reporting factsheet says an initial light-touch notification is due within 24 hours of the provider becoming aware that an incident is taking place, with a fuller report after 72 hours. After the full report, providers must identify customers likely to have been adversely affected and notify them, giving the incident details and the reasons the customer is considered affected, so that customers can act to limit harm.

In plain terms: if your provider is covered and suffers a serious incident, you should hear about it in a structured way rather than by rumour. The thresholds for what counts as "significant" are still to be set in secondary legislation.

Penalties

The enforcement factsheet proposes two bands: up to £17 million or 4% of worldwide turnover, whichever is higher, for more serious breaches, and up to £10 million or 2% of worldwide turnover for less serious ones. Regulators can issue enforcement notices requiring corrective action, and entities can appeal to the First-tier Tribunal. These are caps, not typical outcomes, and the page notes that remedial steps are taken into account.

What if your IT person is a small firm?

Many small businesses use a one or two person IT firm. Those firms are generally outside the main regime. However, the critical suppliers factsheet says small and micro managed service providers can be designated as critical suppliers if they meet the conditions. These include that a regulated provider relies on them, that an incident could significantly affect the economy or daily life in the UK, and that the supply could not realistically be sourced elsewhere. That is a high bar, so most small local IT firms will not be designated, but it shows the rules are meant to follow the supply chain.

Stronger security requirements usually cost providers money to meet. The sources I read do not say whether that will change prices, so it is a fair question to ask at your next renewal rather than something to assume.

Why it matters even if you are tiny

The government's own figures show why this is not a theoretical issue. Its April 2025 announcement said 50% of British businesses suffered a cyber breach or attack in the previous 12 months, and the NCSC's small business guide says half of small businesses reportedly suffer a cyber incident each year. Your IT provider's weaknesses can become your weaknesses.

What to do this week

• Find your contract. Check what your IT provider has access to and whether it includes a duty to tell you about incidents, and how quickly.
• Ask two plain questions. Do you expect to be covered by the Cyber Security and Resilience Bill, and how would you tell us within hours if you were breached?
• List who has admin access. Remove accounts for people and suppliers who no longer need them, and turn on two-step verification for the rest.
• Keep your own copy of key details. Domain registrar logins, licence keys and a list of your systems should not live only with your provider.
• Test your backups. The NCSC small business guide covers backups, protecting devices and accounts, and spotting scams, and says many actions take as little as 5 minutes.

If you would like a second opinion on how your systems, hosting and access are set up, our cloud and security team can review it with you in plain English.

The bottom line

The Bill is a work in progress, and the finer points will be settled by regulations still to be written. But the direction is clear: bigger IT providers will have to meet stronger security standards and tell customers faster when things go wrong. You do not need to do anything legal today. You can, however, start asking better questions of the people who hold the keys to your systems.