The Cyber Security and Resilience Bill, the UK’s biggest overhaul of cyber security law in almost a decade, reaches the House of Lords report stage today, 26 October 2026. For the first time, managed IT providers and data centres will be regulated, incidents will need to be reported within 24 hours, and fines could reach 4% of global turnover. Here is what the Bill does and how to prepare.

Where the Bill stands today

The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to Parliament on 12 November 2025. It completed its Commons stages in June 2026 after being carried over into the new parliamentary session, and was examined in Grand Committee in the House of Lords in September. Report stage, the first point at which the whole House of Lords can vote on amendments, is scheduled for today, 26 October 2026.

After report stage, the Cyber Security and Resilience Bill still needs a Lords third reading and agreement between both Houses before Royal Assent. Royal Assent is widely expected around the end of 2026, although some trackers suggest it could slip into 2027. Many of the detailed obligations will then be switched on through secondary legislation. That gives businesses a short but valuable window to prepare.

Why the government is acting now

The Cyber Security and Resilience Bill updates the Network and Information Systems Regulations 2018, which were written for a very different threat landscape. The government’s own Cyber Security Breaches Survey 2025/2026, published in April, found that 43% of UK businesses, an estimated 612,000 organisations, identified a cyber breach or attack in the previous 12 months. The figure rises to 65% of medium-sized businesses and 69% of large ones.

The cost of getting it wrong has also become impossible to ignore. The attack on Jaguar Land Rover that began in August 2025 was estimated by the Cyber Monitoring Centre to have cost the UK economy around £1.9 billion, making it the most expensive cyber incident in British history. This month, TFG London, owner of Hobbs, Whistles and Phase Eight, disclosed its own cyber incident.

What the Cyber Security and Resilience Bill changes

IT providers come into scope

The Bill creates a new category of regulated business, the relevant managed service provider. Medium and large firms that manage IT, networks or security on behalf of other organisations will need to put appropriate and proportionate security measures in place, register with the regulator and report significant incidents. Micro and small providers, with fewer than 50 staff and turnover of up to €10 million, are excluded from the definition.

Data centres become essential services

Data centres above set thresholds, a rated IT load of 1MW for standalone facilities and 10MW for enterprise data centres, will be treated as essential services and subject to the full set of NIS obligations.

Critical suppliers can be designated

Regulators will be able to designate suppliers whose disruption could cause serious harm to essential services, bringing key parts of the supply chain under the rules even where they are not operators themselves.

Faster, two-stage incident reporting

In-scope organisations will need to send an initial notification of a significant incident within 24 hours, followed by a full report within 72 hours. Data centres and managed service providers will also need to notify customers who are likely to be adversely affected.

Tougher penalties

The standard maximum penalty is the greater of £10 million or 2% of worldwide turnover. For the most serious failures, including security breaches and failures to report incidents, it rises to the greater of £17 million or 4% of worldwide turnover. Daily penalties for continuing non-compliance are also proposed.

New powers over risky suppliers

Government amendments tabled during the Lords stages would give ministers a new power to direct essential and digital service providers to stop buying from, restrict or remove technology supplied by vendors judged to pose a national security risk.

Does it affect you if you are not in scope?

Almost certainly. Even if your business is too small or in the wrong sector to be regulated directly by the Cyber Security and Resilience Bill, your customers, IT provider or data centre may be. Regulated organisations will push security and reporting requirements down through their contracts, and suppliers that cannot show good practice risk losing work. For many UK SMEs, the Bill will arrive first as a new set of questions in a tender or contract renewal.

6 steps to prepare for the Cyber Security and Resilience Bill

• Confirm your position. Work out whether you are likely to be an operator of essential services, a relevant managed service provider, a data centre in scope or a supplier to any of these.
• Map your suppliers. List every provider that manages your IT, hosts your data or has privileged access to your systems, and check how each is preparing.
• Build a 24-hour reporting capability. You cannot report what you cannot see. Centralised logging, clear escalation paths and a named decision-maker are the foundations.
• Put cyber on the board agenda. Only 31% of UK businesses have board-level responsibility for cyber security. The Cyber Security and Resilience Bill’s penalty regime makes that a governance risk, not just an IT one.
• Review your contracts. Check incident notification, audit and security clauses with both customers and suppliers, and update them before the rules bite.
• Benchmark against recognised standards. Cyber Essentials and the NCSC’s Cyber Assessment Framework are practical starting points while the detailed regulations are written.

The bottom line

The Cyber Security and Resilience Bill turns cyber security from good practice into a legal duty for a much wider group of UK businesses. The organisations that use the next few months to get their visibility, reporting and supply chain in order will find compliance straightforward. Those that wait for Royal Assent will be playing catch-up under a far tougher regime.

Find out where you stand before the rules arrive

Cloud Technology Hub helps UK organisations assess their readiness for the Cyber Security and Resilience Bill, from supplier mapping and centralised logging to incident response planning, backed by our technology partners Sophos and JumpCloud.

Speak to our team at info@technohub.cloud. TALK

Leave a comment and Read More Here