The Cyber Security and Resilience Bill was introduced to Parliament in November 2025. It updates the UK’s Network and Information Systems (NIS) Regulations from 2018, which cover essential services such as energy, transport, water, healthcare and digital infrastructure.
The bill is still going through Parliament, and many of the details will be set later in secondary legislation. The overall direction is already clear, though.
What the bill does
- Brings suppliers into scope. Medium and large managed service providers, the companies that run IT systems for other organisations, will be regulated for the first time, along with data centres. Small and micro businesses are exempt.
- Requires faster incident reporting. Regulated organisations will have to report significant cyber incidents quickly, with an initial notice within 24 hours.
- Increases penalties. The most serious breaches could lead to fines of up to £17 million or 4% of turnover, whichever is higher.
- Gives ministers new powers to direct regulated organisations when there’s a threat to national security.
Does it affect your business?
If you’re a small business that doesn’t provide essential services, you probably won’t be regulated directly. You may still feel the effects. Larger customers that are regulated will look harder at the security of their suppliers, and questions about software updates, backups and access control are already turning up in supplier questionnaires and tenders.
The attacks the bill is aimed at don’t only hit big organisations, either. Automated attacks don’t care how big a business is. They scan the web for out-of-date software and break in wherever they find it.
The basics that protect everyone
- Keep WordPress, themes and plugins up to date, and remove the ones you don’t use.
- Turn on two-factor authentication for every admin account.
- Take backups automatically, keep them off the server, and check they actually restore.
- Give people only the access they need, and remove accounts when someone leaves.
- Know who your suppliers are and what access they have.
- Decide in advance what you’ll do, and who you’ll call, if something goes wrong.
If you want a recognised standard to work towards, the government-backed Cyber Essentials scheme covers most of this.
How we help
The websites we host are monitored around the clock, updated for you and backed up. If you’re not sure how well your website would hold up, talk to us and we’ll take a look.
