Cyber Security and Resilience (Network and Information Systems) Bill
The UK's post-Brexit update to the NIS Regulations 2018, broadly mirroring the EU's NIS2 while reflecting UK-specific priorities. It expands regulatory scope to managed service providers and data centres, and introduces a new “critical suppliers” designation.
Who it applies to
- Operators of essential services in energy, health, transport, water and digital infrastructure
- Managed service providers and qualifying data centre operators
- Suppliers designated as “critical” to an in-scope organisation's essential service
Key requirements
- Appropriate and proportionate supply chain risk management
- 24-hour initial incident notification, 72-hour detailed reporting
- Alignment with the NCSC's Cyber Assessment Framework outcomes
- Cooperation with expanded regulator information and inspection powers
- Board-level ownership of cyber risk
Maximum penaltyUp to £17 million or 4% of global turnover, plus daily penalties of up to £100,000 for ongoing non-compliance
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
The Cyber Security and Resilience Bill applies to: Operators of essential services in energy, health, transport, water and digital infrastructure; Managed service providers and qualifying data centre operators; Suppliers designated as “critical” to an in-scope organisation's essential service.
The core obligations are: Appropriate and proportionate supply chain risk management; 24-hour initial incident notification, 72-hour detailed reporting; Alignment with the NCSC's Cyber Assessment Framework outcomes; Cooperation with expanded regulator information and inspection powers; Board-level ownership of cyber risk. Each is summarised in plain English above, with a link to the official text.
Effective: Introduced to Parliament 12 November 2025; phased implementation expected 2026–2028. Regulator: Department for Science, Innovation & Technology (DSIT) & sector regulators.
Up to £17 million or 4% of global turnover, plus daily penalties of up to £100,000 for ongoing non-compliance.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under the Cyber Security and Resilience Bill, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, supplier and processor obligations run through Third-Party Risk Management.
See how Praeferre automates UK Cyber Security & Resilience Bill compliance
Continuous monitoring, evidence and reporting for UK Cyber Security & Resilience Bill — alongside every other framework you need to satisfy.