Skip to content
HACKTECH
RegulationReported Published 5 sources

UK Cyber Security and Resilience Bill clears the Lords and returns to the Commons

The Cyber Security and Resilience (Network and Information Systems) Bill completed its House of Lords third reading on 2 November 2026 and is now at consideration of Lords amendments in the House of Commons, according to the UK Parliament bill record. Introduced on 12 November 2025, the bill would reform the Network and Information Systems Regulations 2018 and, according to the government, bring medium and large managed service providers into regulation for the first time and data centres into scope. As introduced, organisations in scope would have to report more harmful cyber incidents to their regulator and the National Cyber Security Centre within 24 hours, with a full report within 72 hours.

  • UK
  • NIS Regulations
  • incident reporting
  • managed service providers
  • data centres
  • NCSC

What the sources report

  • Commons stages (UK Parliament record): first reading 12 November 2025, second reading 6 January 2026, committee sittings in February 2026, then report stage and third reading on 16 June 2026, after the bill was carried over and reintroduced on 14 May 2026.
  • Lords stages: second reading 14 July 2026, committee sittings on 1, 3 and 7 September 2026, report on 26 October 2026 and third reading on 2 November 2026. The Lords amendments were published as Bill 175 (2026-27) on 3 November 2026.
  • The record lists a Commons carry-over motion dated 4 November 2026 and no sitting date yet for consideration of Lords amendments. Legislative consent motions were agreed by the Scottish Parliament (7 October 2026), the Northern Ireland Assembly (19 October 2026) and the Senedd (20 October 2026).
  • As introduced, managed service providers would have to report significant or potentially significant incidents to government and their customers and have plans in place to deal with the consequences. Data centres and digital and managed service providers would have to notify customers likely to be affected promptly.
  • Regulators would gain powers to designate critical suppliers, penalties for serious breaches would become turnover-based, and the Technology Secretary could direct regulators and regulated organisations to take specific steps, such as stronger monitoring or isolating high-risk systems, where there is a threat to national security.
  • The government cited research putting the average cost of a significant cyber attack in the UK at over £190,000, amounting to around £14.7 billion a year across the economy. It said the Synnovis incident disrupted over 11,000 medical appointments and procedures.

What it means for your organisation

If the bill becomes law, security for in-scope managed service providers and data centres moves from contract terms to legal duties, and their customers would receive incident notices because the law requires them. A 24-hour initial report needs detection, triage and an accountable decision-maker in place before an incident happens. Both of the government's own examples, the Ministry of Defence payroll compromise via a managed service provider and the Synnovis attack, began at a supplier.

What we check

  • Establish whether the organisation, its managed service providers or its data centre operators are likely to be in scope, and which regulator would oversee them.
  • Exercise an incident scenario against a 24-hour initial report and a 72-hour full report, including who approves the report and how the regulator and NCSC are contacted.
  • Test managed service provider and supplier access paths: privileged accounts, MFA, network segmentation and logging of third-party remote sessions.
  • Check contracts and runbooks for customer incident notification from MSPs and data centres, so notices received can be acted on quickly.
  • Map controls against the NCSC Cyber Assessment Framework, which the government points to for the most critical organisations.

Sources

Services that cover these checks

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works