# The Cyber Security and Resilience Bill: what UK businesses should know

- Link: https://eprefix.co.uk/cyber-security-and-resilience-bill/
- Published: 2026-10-07T09:00:00+00:00
- Author: jameszxr

The Cyber Security and Resilience Bill was introduced to Parliament in November 
2025. It updates the UK’s Network and Information Systems (NIS) Regulations from
2018, which cover essential services such as energy, transport, water, healthcare
and digital infrastructure.

The bill is still going through Parliament, and many of the details will be set 
later in secondary legislation. The overall direction is already clear, though.

## What the bill does

 * **Brings suppliers into scope.** Medium and large managed service providers, 
   the companies that run IT systems for other organisations, will be regulated 
   for the first time, along with data centres. Small and micro businesses are exempt.
 * **Requires faster incident reporting.** Regulated organisations will have to 
   report significant cyber incidents quickly, with an initial notice within 24 
   hours.
 * **Increases penalties.** The most serious breaches could lead to fines of up 
   to £17 million or 4% of turnover, whichever is higher.
 * **Gives ministers new powers** to direct regulated organisations when there’s
   a threat to national security.

## Does it affect your business?

If you’re a small business that doesn’t provide essential services, you probably
won’t be regulated directly. You may still feel the effects. Larger customers that
are regulated will look harder at the security of their suppliers, and questions
about software updates, backups and access control are already turning up in supplier
questionnaires and tenders.

The attacks the bill is aimed at don’t only hit big organisations, either. Automated
attacks don’t care how big a business is. They scan the web for out-of-date software
and break in wherever they find it.

## The basics that protect everyone

 * Keep WordPress, themes and plugins up to date, and remove the ones you don’t 
   use.
 * Turn on two-factor authentication for every admin account.
 * Take backups automatically, keep them off the server, and check they actually
   restore.
 * Give people only the access they need, and remove accounts when someone leaves.
 * Know who your suppliers are and what access they have.
 * Decide in advance what you’ll do, and who you’ll call, if something goes wrong.

If you want a recognised standard to work towards, the government-backed [Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview)
scheme covers most of this.

## How we help

The websites we host are monitored around the clock, updated for you and backed 
up. If you’re not sure how well your website would hold up, [talk to us](https://eprefix.co.uk/#contact)
and we’ll take a look.