The UK Cyber Security And Resilience Bill: What You Need To Know

The UK Government has recently introduced the Cyber Security and Resilience (Network and Information Systems) Bill (Bill), which seeks to strengthen cyber security across organisations that underpin the delivery of essential services and digital infrastructure in the UK. The Bill was first announced during the King's Speech in July 2024 and is currently progressing through Parliament. 

What is the purpose of the Bill? 

The Bill will materially enhance the existing Network and Information Systems (NIS) Regulations 2018 (NIS Regulations), which impose baseline security and incident reporting obligations on operators of essential services and digital service providers. Whilst the NIS Regulations represented a significant step forward in establishing a minimum standard of cyber security across critical sectors – including energy, transport, water, health, and digital infrastructure – the UK Government has identified significant gaps in the existing framework, in particular, its limited scope and the insufficiency of the obligations it imposes relative to the rapidly evolving cyber threat landscape. 

The consequences of cyber incidents for both public services and the wider economy can be profound. By way of illustration, the Government’s press release accompanying the Bill cited the cyber-attack on Synnovis, a pathology services provider to the NHS, which resulted in the cancellation of approximately 11,000 appointments at an estimated cost to the public purse of £32.7 million. This example highlights both the operational disruption and substantial financial burden that cyber incidents can impose on critical public services and UK taxpayers alike. The Government has therefore emphasised the need to enhance cyber security measures for essential service providers and the Bill represents the primary legislative mechanism for cyber security reform. 

What are the new measures?

The Bill proposes three categories of reform to the NIS Regulations:

1. Expanding the scope 

Since the NIS Regulations came into force, cyber criminals have developed increasingly sophisticated methods of attack, targeting organisations involved in the delivery of essential services or providing services to those organisations. The Bill seeks to extend the scope of the NIS Regulations to capture a broader range of organisations within the ambit of providers of essential or critical providers of services, including:

• Data centres;
• Managed service providers (MSPs);
• ‘Large load controllers’; and
• Designated critical suppliers to existing essential service providers (i.e. health services, energy networks, water infrastructure and transport operators).

Examining a couple of these new additional categories:

Data centres and MSPs are being brought within scope so as to mirror the regulatory ambit of the EU NIS2 Directive. Data centres have been particularly in focus as digital infrastructure is seen more and more as critical national infrastructure (CNI) and governments and regulators see the potential threats and risk to the operational resilience of broader networks and the digital economy as it becomes increasingly reliant on digital infrastructure. At the same time, CNI is a target for threat actors and external attackers looking to trigger an outage or disrupt local, national and international services, as we have seen in the context of subsea cables and patrolling Russian warships in and around the UK.

‘Large load controllers’ are defined as: an organisation that can remotely control or manage substantial amounts of electricity demand from connected smart devices, typically to help balance the electricity grid. 

Examples include organisations that manage:

• Electric vehicle charging networks
• Battery energy storage systems
• Domestic or commercial heat pumps
• Other 'smart' energy appliances that can increase, reduce, or shift electricity consumption in response to market or grid signals. 

The Government considers these entities increasingly critical to the operation of the UK's electricity system as it transitions to a more flexible, digitalised energy network. Because a single controller may influence very large amounts of demand simultaneously, a cyber attack could potentially cause grid instability or disruption by turning loads on or off at scale. The proposed threshold is 300MW or more of controllable electrical load. Organisations capable of controlling electrical demand at or above that level would be designated and brought within the NIS regulatory regime. For instance, a demand-side response aggregator managing:

• 150,000 EV chargers, or
• a large fleet of battery storage assets,

could potentially control hundreds of megawatts of demand. If compromised, an attacker might be able to switch those loads simultaneously, creating stress on the electricity system. The Bill seeks to reduce that risk through mandatory cyber resilience measures.

This is of particular relevance, for instance to connected vehicle cybersecurity, because many future EV charging and vehicle-to-grid (V2G) platforms could fall within the large load controller concept. Operators managing charging demand at scale may become regulated entities under the NIS framework, with corresponding obligations around security controls, incident reporting, supply chain assurance, and regulatory oversight.

As a consequence, an organisation that manages or controls electricity consumption from large numbers of connected energy devices, such as electric vehicle chargers and battery storage systems, with the ability to influence at least 300 MW of electrical load, would be designated as a critical operator and regulated under the Bill.

2. Extraterritorial reach 

The Bill also has extra territorial reach, meaning non UK organisations providing services into the UK may be caught.

3. Enhancing the power of regulators

The NIS Regulations are currently enforced by sector-specific regulators, enabling the particular requirements of each sector to be taken into account. Whilst this sectoral approach has merit, the UK Government has identified inconsistencies in enforcement across regulators.

The Bill seeks to ensure greater consistency of enforcement across regulators and to enhance their powers, including in the following areas:

• Reporting requirements: The Bill proposes to lower the reporting threshold so that incidents with the potential to cause a significant impact must also be reported, in addition to those that have already caused such an impact. Reporting deadlines will also be tightened: an initial notification must be submitted to the relevant regulator and the National Cyber Security Centre within 24 hours of an incident being identified, followed by a detailed incident report within 72 hours.
• Strategic priorities: The UK Secretary of State will be empowered to issue strategic priorities for regulators, promoting consistent enforcement across sectors.
• Cost recovery: Regulators will be permitted to recover the full costs of their oversight and enforcement activities directly from regulated entities, reducing the burden on public finances and creating a stronger incentive for regulated entities to maintain compliance. 
• Information sharing: The Bill will clarify the scope of information that regulators and regulated entities may share with one another and with law enforcement agencies, facilitating a more coordinated response to cyber threats. 
• Enforcement powers: Regulators gain stronger powers to request information, conduct inspections, and impose turnover-based penalties.
• Regulatory fines: The penalty framework for non-compliance will be clarified and simplified, with a standard maximum fine of £10 million or 2% of turnover and a higher maximum fine of £17 million or 4% of turnover, depending on the nature of the breach. This is akin to the maximum fines that may be imposed under UK and EU GDPR.
• Customer notification: Data centre operators, relevant digital service providers and managed service providers will be required to notify customers who are likely to be adversely affected by an incident, following the submission of a full incident report to the relevant regulator.

4. Enabling resilience 

The Bill will grant the Government broader powers to respond to cyber security threats, including through secondary legislation to expand the scope of the NIS Regulations, the ability to direct regulators and regulated entities to take specific action in the interests of national security, and the power to issue a statutory Code of Practice setting out recommended measures for compliance with the NIS Regulations.

What does this mean for your organisation?

Although the Bill is still proceeding through Parliament, it demonstrates a clear commitment by the UK Government to strengthening cyber resilience across the UK's critical infrastructure and public services.

If your organisation was not previously required to comply with the NIS Regulations, for example, as a data centre operator, managed service provider, large load controller or critical supplier, you may now fall within scope of the new cybersecurity framework and will need to assess your readiness to meet the enhanced obligations ahead of the Bill receiving Royal Assent and entering into force (which is likely to take effect from the end of 2026).

The proposed measures will give rise to a number of material practical implications that will require careful consideration. In particular, you should assess:

• A board-level priority and cross-disciplinary approach: Whether your organisation treats cyber resilience as a board-level priority, moving beyond 'tick box' compliance to an embedded, board-endorsed approach. The Bill requires integration of cyber resilience with broader legal and operational frameworks (e.g. data protection, AI governance, outsourcing), and you should assess whether your current governance structures reflect this;
• Scope: Whether your organisation falls within the expanded scope, either as a newly designated category of regulated entity or as a critical supplier to an operator of essential services. In addition, organisations must manage multi-jurisdictional compliance complexity, especially for cross-border incident response and reporting.
• Incident reporting: Whether your existing incident response and reporting procedures are sufficient to meet the tightened reporting deadlines, including the requirement to submit an initial notification within 24 hours and a detailed report within 72 hours;
• Supply chain resilience: The resilience of your supply chains, noting that cyber resilience becomes a formal obligation across supply chains under the Bill, not just for regulated entities. High-impact suppliers will be designated as ‘critical suppliers' and subject to obligations similar to those imposed on operators of essential services. You should assess whether your existing contractual arrangements with third-party providers adequately address the enhanced regulatory requirements, including any obligations that may flow down to critical suppliers within the supply chain;
• Updated Cyber Framework: Whether your organisation's cyber security risk management practices align with the updated Cyber Assessment Framework (CAF), developed by the UK National Cyber Security Centre (NCSC), which sets out cyber security risk management outcomes that organisations should seek to achieve. You should also have regard to the NCSC's updated technical and strategic guidance for operators of operational technology (OT), which is of specific relevance to the Bill;
• Insurance: Whether the specific policy wording and conditions of relevant insurance cover are adequate, including whether there are any gaps, and whether external legal advice should be sought from insurance policy and cover specialists in relation to disclosures and risk pinch-points;
• Cost recovery: The potential financial impact on your organisation of the new cost recovery regime, under which regulators may pass on the full costs of their oversight and enforcement activities to regulated entities; and
• Penalty framework: The implications of the strengthened penalty framework for non-compliance, which may result in higher maximum fines where proportionate.

If your organisation may be affected by the Bill, we recommend that organisations review current cyber security policies, governance frameworks and incident response plans at an early stage to ensure you are well-positioned to comply with the new requirements once enacted. Most importantly, we recommend that organisations review transformational compliance and culture programmes to reflect the fact that operational resilience is essential to day-to-day business as usual activities – and not to treat regulatory compliance as an onerous burden. Governance is a facilitator and enabler and the most successful organisations are proactive in their approach in adapting to the updated threat, risk and corresponding regulatory framework.