The Cyber Security and Resilience Bill: What It Means for Your Suppliers

Updated 13 October 2026: the Bill has completed Lords committee stage. Status, timeline, reporting deadlines and a readiness checklist added.

The UK's biggest overhaul of cyber security law in nearly a decade is in its final parliamentary stages — and this time, the supply chain is squarely in the frame.

The Cyber Security and Resilience (Network and Information Systems) Bill was introduced on 12 November 2025, passed the House of Commons on 16 June 2026, had its Lords second reading on 14 July and completed Lords committee stage in September. Report stage — the Lords' last real chance to amend it — is next. For any organisation that relies on suppliers, which is every organisation, the most important thing to understand about this Bill is simple: your third parties are no longer someone else's problem in the eyes of the law.

Has the Cyber Security and Resilience Bill been passed?

Not yet. As of October 2026 it has passed the Commons, completed Lords committee stage and is awaiting Report stage in the House of Lords. Commentators expect Royal Assent between late 2026 and spring 2027. Even then, most of the operational detail — reporting thresholds, security requirements, which suppliers are designated critical — arrives afterwards through secondary legislation and regulator guidance, so duties will phase in rather than switch on in a single day.

Note the name: it is a Bill, not an Act, until it receives Royal Assent. You may see it called the "UK Cyber Resilience Act" — that is informal, and easily confused with the EU's Cyber Resilience Act, which is a different law (see below).

Timeline

What the Bill actually does

At its core, the Bill modernises and expands the Network and Information Systems (NIS) Regulations 2018, the UK's inherited framework for protecting essential services. When those rules were written, the threat landscape looked very different. Since then, attackers have learned that the fastest way into a well-defended organisation is often through a weaker one connected to it — a supplier, a managed service provider, a piece of software buried three tiers down in the chain.

The Bill responds in four main ways:

• It widens scope. Medium and large managed service providers come into regulation for the first time, overseen by the Information Commission. Data centres meeting the thresholds become essential services, regulated by Ofcom. Large load controllers — organisations managing electrical load for smart appliances such as EV chargers — are brought in too.
• It lets regulators designate critical suppliers, bringing individual suppliers under regulation even if they would otherwise sit outside it. The regime is modelled on the financial-services critical third parties regime.
• It tightens incident reporting — an initial notification within 24 hours and a full report within 72 hours (detail below).
• It strengthens regulators and government. Regulators can recover their full costs, the maximum penalties will be raised and the bands simplified, the Secretary of State can set strategic priorities for regulators, and the government gains powers to direct regulators and regulated organisations in response to threats to national security.

The real headline: third parties are now in scope

Two provisions matter most for third-party risk.

The first is the treatment of managed service providers. MSPs — the firms that remotely manage IT systems, security tooling and infrastructure for other organisations — have long occupied a privileged position: deep access to their customers' environments, but light regulatory scrutiny. The Bill changes that, bringing medium and large MSPs into scope with their own security and incident-reporting obligations. If you outsource the management of your systems, the organisation holding the keys will soon carry legal duties of its own.

The second, and more novel, is the designated critical supplier. Regulators will be able to bring suppliers whose disruption could cause significant harm to essential or digital services directly under regulatory obligations — even if they would not otherwise have been regulated. That is notably more interventionist than the EU's NIS2 Directive, which regulates essential entities but stops short of directly regulating their individual suppliers. We cover who is likely to be designated, and four questions to ask, in Are you a 'critical supplier' under the Cyber Security and Resilience Bill?

One more supplier provision is still in play. In Lords committee on 1 September 2026 the government tabled a package of amendments letting the Secretary of State direct operators of essential services over their use of goods or services from vendors that pose national-security risks — with scope to introduce mandatory procurement screening later. Watch Report stage to see what survives into the final Bill: if it does, the law will reach into vendor selection itself, not just vendor security.

For security and procurement leaders, the implication is unavoidable. Supplier risk is shifting from good practice and contractual comfort to legal obligation — for your suppliers and, through your own due-diligence duties, for you.

Incident reporting: 24 hours, then 72

Regulated organisations will have to send an initial notification within 24 hours of becoming aware of a significant incident, and a full report within 72 hours, to their regulator — with the National Cyber Security Centre informed at the same time. Data centres, digital service providers and managed service providers must also tell customers who are likely to have been affected. The precise thresholds will be set in secondary legislation.

The practical effect is that incidents in your supply chain will surface faster and more visibly than they do today. An MSP compromise or a critical-supplier outage that might once have been quietly managed becomes a reportable, documented event — and your own 24-hour clock may depend on how quickly your supplier tells you.

When that happens, "we didn't know" will be an increasingly difficult position to defend — to a regulator, to a board, or to customers.

The UK Bill, NIS2 and the EU Cyber Resilience Act

Three laws are easily confused:

Does the EU Cyber Resilience Act apply to the UK? Not as UK law. It applies to UK manufacturers, importers and distributors only when they place products with digital elements on the EU market. The UK's own reform is this Bill, which is about protecting services and their supply chains, not certifying products.

Organisations with EU operations may face NIS2 and, in financial services, DORA alongside this Bill. All three put heavy weight on third-party risk, and the direction is the same: responsibility for cyber risk no longer ends at your own perimeter. The practical answer is not three compliance projects but one coherent approach to supplier risk. Our NIS2 guide covers the EU side.

Getting ready: a readiness checklist

The Bill is not yet law, and the detail will be refined at Report stage and in secondary legislation. But the direction is settled, and organisations that prepare now will treat the eventual deadline as a formality rather than a fire drill.

1. Confirm whether you are in scope. Are you an operator of essential services, a relevant digital service provider, a medium or large MSP, or a data centre above the thresholds? If you supply any of them, could you be designated a critical supplier?
2. Build a complete supplier inventory. Most organisations can name their top ten vendors but lose visibility beyond that, and almost none can map their fourth parties. List who you depend on and what access or data each holds.
3. Tier your suppliers and identify the critical ones. Work out which third parties, if disrupted or breached, would cause significant harm. These attract the most regulatory attention and deserve the most scrutiny now.
4. Rehearse the 24-hour clock. Decide who owns incident reporting, how a supplier incident reaches you, and whether you could notify a regulator within 24 hours and file a full report within 72.
5. Rewrite supplier notification terms. Supplier contracts should require incident notification fast enough for you to meet your own deadlines — hours, not "without undue delay".
6. Move from point-in-time to continuous assurance. Annual questionnaires capture a supplier's posture on one day a year. Continuous, outside-in monitoring gives the ongoing visibility the new regime assumes.
7. Treat your MSPs as part of your attack surface. The firms with the deepest access warrant the deepest assurance.
8. Keep the evidence. Be able to show a regulator what you knew about each critical supplier, when, and what you did about it.

Visibility, not trust

The through-line of the Cyber Security and Resilience Bill is that trust is no longer a control. Assuming a supplier is secure because it is large, reputable, or has signed a questionnaire is precisely the assumption attackers exploit. What the Bill asks — and what resilience genuinely requires — is a clear, current, evidence-based view of the security of every organisation you depend on.

That is a demanding standard, but an achievable one. RiskXchange runs it for you: The Agency pre-populates supplier questionnaires from the evidence they already hold, checks every answer against our own continuous outside-in rating, chases suppliers until the evidence arrives, and produces regulator-ready reporting from live data. See how it works on your own suppliers — book a 30-minute demo.