Close-up of a server unit in a blue-lit data centre

The Cyber Security and Resilience Bill is nearly law: what CISOs should do now

The UK's biggest update to its cyber security law since 2018 is almost through Parliament. The Cyber Security and Resilience (Network and Information Systems) Bill completed its third reading in the House of Lords on Monday 2 November 2026. MPs are due to consider the Lords' amendments on 24 November, and after that the Bill can go for Royal Assent.

Most of the detail will come later in secondary legislation, so there is no need to panic. But the direction is now settled, and several of the changes will land on security teams first. Here is what the Bill does, what changed in the Lords, and what CISOs can do while the detail is worked out.

What the Bill does

The Bill updates the Network and Information Systems (NIS) Regulations 2018, the UK's only cross-sector cyber law. The government describes three pillars of reform.

Wider scope. The NIS rules already cover energy, transport, health, drinking water, digital infrastructure and some digital services such as cloud computing, online marketplaces and search engines. The Bill adds:

Data centres, which become an essential service regulated by Ofcom. Facilities with a rated IT load of 1 megawatt or more are in scope, rising to 10 megawatts for enterprise data centres that only serve their owner's own IT needs.
Medium and large managed service providers (MSPs), regulated by the Information Commission (formerly the ICO). This covers ongoing IT management under contract, such as remote support, helpdesks, infrastructure management and managed security services like a security operations centre.
Large load controllers, which manage electrical demand for things like electric vehicle charging.
Designated critical suppliers. Regulators will be able to name suppliers whose disruption could cause significant harm to an essential or digital service, and place security duties on them.

Stronger regulators. Incident reporting gets faster and broader (more on this below). The government will set a statement of strategic priorities for regulators, regulators can recover their costs, and information sharing is clarified. Fines also go up. The current maximum is £17 million. Under the Bill, the higher band rises to £17 million or 4% of worldwide turnover, whichever is higher, and the standard band to £10 million or 2%.

New powers for government. Ministers will be able to update the regime through secondary legislation, for example to add sectors, and to direct regulated organisations to take specific action when a threat puts national security at risk. The government's own example is a direction to carry out a technical investigation for signs of a hostile actor on a network.

What changed in the Lords

At report stage on 26 October, peers voted through two amendments. One requires the government to review how well the NIS scheme is working within twelve months. The other requires it to keep a register of state actors that pose a threat to UK cyber security. A third amendment, on reporting incidents involving frontier AI models, was voted on and rejected.

Peers also debated voluntary reporting of near misses, bringing software makers under the NIS framework, protection for good-faith security researchers, support for SMEs, and board accountability. None of these were added, but they show where the pressure is likely to come from next.

The change most CISOs will feel first: incident reporting

Today, organisations under NIS only have to report incidents that have already caused significant disruption, within 72 hours. That leaves out attacks where someone is inside the network but has not yet pulled the trigger.

The Bill changes this in three ways:

A wider trigger. Incidents that are likely to have a significant impact must be reported, even if no service has been disrupted yet. The government gives ransomware and pre-positioning attacks as examples.
Two stages. A short first notice is due within 24 hours of becoming aware of an incident, with only basic details. A fuller report follows within 72 hours. The NCSC is told at the same time as the regulator.
Telling customers. Data centres, managed service providers and digital service providers will have to tell customers who are likely to have been affected.

The exact thresholds for "significant" will be set in secondary legislation after consultation, supported by regulator guidance.

What CISOs can do now

You do not need final regulations to start preparing. Most of this is good practice anyway.

Work out where you sit. Are you an operator of an essential service, a digital service provider, an MSP, a data centre operator, or a likely critical supplier to one of those? Many organisations will be more than one. If you are a medium or large MSP, expect to register with the Information Commission within three months of the rules coming into force.
Test a 24-hour notification. Run a tabletop exercise where the clock starts when the team first suspects an intrusion, not when systems go down. Who decides that an incident is reportable? Who sends the notice, and who signs it off at 3am on a Sunday?
Map your suppliers. List the managed service providers, data centres and other suppliers that could take your services down. Check that your contracts require them to tell you quickly about incidents, because the Bill will soon require many of them to.
Brief the board. Turnover-based fines and new direction powers move cyber resilience further into board territory. The government's Cyber Governance Code of Practice is a useful starting point for that conversation.
Line up your evidence. The NCSC's Cyber Assessment Framework (now version 4.0) is the main tool NIS regulators use. A self-assessment against it now will show where the gaps are before a regulator asks.
Get to know your regulator and the NCSC. The NCSC and the FCA recently set out how sharing cyber incident information with the NCSC can fit with disclosure obligations. Relationships built before an incident make the first 24 hours much easier.
Watch for the consultations. The government plans to consult on implementation, including reporting thresholds, critical supplier duties and turnover rules. Security teams that respond will help shape rules they then have to live with.

What we do not know yet

The government says the Act will come into force in phases. Some measures, such as the futureproofing powers, apply from day one after Royal Assent. Information sharing and the statement of strategic priorities follow at month two. Most of the measures that affect security teams, including incident reporting, data centres, MSPs, critical suppliers and the powers of direction, will need secondary legislation first, and the government has promised a business adjustment period before new duties apply.

So the honest answer to "when do I need to comply?" is: not yet, but sooner than most budgets assume. The organisations that will find this easy are the ones that already know their suppliers, can make a decision on an incident inside a day, and have a board that understands what is at stake.