United Kingdom. Cybersecurity. Bill
CS&R BillCyber Security and Resilience Bill
Partly verified
Medium confidence.Proposed reporting times and penalty levels are from the bill as introduced and may change at Lords stages.
§1Summary
- Synopsis
Government bill to update the NIS Regulations 2018 by bringing managed service providers and data centres into scope, empowering designation of critical suppliers, tightening incident reporting and increasing regulators' powers. Has passed the Commons and is at Lords Report stage.
- Key themes
- Unique features
Proposes a 24-hour initial incident notification with fuller report within 72 hours and turnover-based penalties, moving the UK closer to NIS2.
- SaaS relevance
Managed IT service providers and larger SaaS/cloud businesses serving UK customers are likely to become regulated entities or critical suppliers.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Proposed: initial notification 24h, full report 72h
- DPO
- No
- Maximum penalty
- Proposed turnover-based fines (figures subject to final text)
§3Dates
- Key dates
- Introduced in Commons November 2025; Commons second reading January 2026; passed Commons; House of Lords Report stage as of 15 October 2026; no Royal Assent
§4Text and authority
- Text
- Authoritative text bills.parliament.uk
- Authority
- Sector regulators; ICO (digital services); DSIT
§5Where it applies
- Domestic law of
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Proposed reporting times and penalty levels are from the bill as introduced and may change at Lords stages.