The Government’s Cyber Security and Resilience (Network and Information Systems) Bill, introduced to Parliament on 12 November 2025, represents the UK’s most substantive refresh of the NIS framework since 2018.
For government, critical infrastructure and other regulated services, the bill signals a broader shift in what “good” looks like. It means tougher cyber-resilience expectations, faster incident reporting, stronger oversight and accountability, and a higher bar for security across both organisations and their supply chains.
What is the UK Cyber Security and Resilience Bill?
Proposed new laws are designed to strengthen cyber defences for essential public services like healthcare, drinking water providers, transportation, and energy, with clearer expectations of executive accountability and stronger powers for the Government and regulators to test, direct and, where necessary, sanction.
When will it come into force?
Assuming a smooth passage, secondary legislation and sector guidance will follow through 2026, and it is prudent to plan on the basis that the regime will bite from mid-year.
Key changes introduced by the Cyber Security and Resilience Bill
How does the Cyber Security and Resilience Bill expand scope?
At its core, the Bill widens the net. In addition to traditional essential service operators, it brings data centres, managed service providers, and designated critical suppliers within scope, alongside certain actors in the energy system.
The Government’s intent is straightforward: if an organisation’s failure could materially disrupt essential services or the wider economy, it should meet a defined bar for cyber resilience and be capable of proving it.
What incident reporting changes does the Bill introduce?
Complementing this, the Bill tightens incident reporting, expecting an initial notification to competent authorities and the NCSC within twenty-four hours and a fuller account within seventy-two hours, with providers notifying affected customers where applicable.
What penalties and regulatory powers are introduced?
Regulators are equipped with enhanced information gathering and direction powers and the ability to recover costs of oversight.
Penalties rise to the greater of £17 million pounds or 4% of global turnover for serious failures, meaning large organisations could face fines on a scale comparable to the operational disruption caused by a major incident.
It is a clear signal that weak governance and slow or inaccurate reporting now carry significant financial and reputational risk.
How does the Bill affect supply chain and third parties?
If you rely on suppliers who are designated critical or operate out of in scope data centres, they will be drawn into faster reporting cycles and greater scrutiny of third-party controls.
Managed service providers should assume a regulated posture. Privileged access must be tightly governed. Incident playbooks must contemplate customer notification duties. Assurance evidence must be readily available to clients and regulators alike.
Across the board, the cultural implication is as important as the technical one: resilience is now an auditable business discipline, not an engineering aspiration.
What does the Cyber Security and Resilience Bill mean for boards?
Boards will need clear sight of cyber risk and control health, with service owners able to trace essential functions through to the applications, physical and cloud locations, including data centre regions, and suppliers on which they depend.
Why the Cyber Security and Resilience Bill matters
Broadly, the regime points to the NCSC’s Cyber Assessment Framework as the yardstick for what good looks like, and its requirements are expected to be put on a stronger footing.
In practical terms, organisations will be expected to show mature governance and risk management, robust identity and access controls, credible monitoring and detection, well-rehearsed response and recovery, and a cycle of learning, each evidenced in a way a regulator can examine.
How should organisations prepare now?
The immediate question is how to react while the bill progresses and secondary rules are drafted.
The sensible approach is to behave as if the obligations already exist, and to concentrate on three themes: evidence, speed, and dependency clarity.
Evidence means aligning governance, risk, and controls to Cyber Assessment Framework outcomes and being able to show, not merely assert, that they work: who owns each control, how it is tested, what was found, and what was fixed.
Speed means industrialising incident command so that detection, triage, legal determinations and executive approvals are orchestrated and time stamped, enabling accurate submissions within twenty-four and seventy-two hours and, where required, prompt customer notifications.
Dependency clarity means mapping essential services to the systems, data centres, regions and suppliers that underpin them, including privileged access by managed service providers, so that single points of failure, failover routes and communications paths are unambiguous.
Bottom line
Assurance is becoming a statutory duty and evidence the currency in which it is measured.
Organisations that start now, by aligning to the Cyber Assessment Framework, industrialising incident reporting, mapping their dependencies and tightening supplier governance, will not only meet the letter of the law when it arrives; they will be materially more resilient, more efficient and more transparent to their stakeholders.
How Wrangu and ServiceNow can help
Wrangu applies the power of the ServiceNow AI Platform in the context of UK public service.
In governance, risk and compliance, ServiceNow Integrated Risk Management capabilities allow departments and regulated entities to model objectives and principles as first class objects, link them to specific risks and controls, and attach evidence in one system of record. This produces regulator ready reporting without the evidence chase that so often undermines credibility.
In security operations, ServiceNow Security Incident Response and Major Incident Management codify the twenty-four and seventy-two hour reporting journey. Alerts are triaged, forensic notes and legal assessments are captured, decision points are recorded with approvals, and initial and full reports can be generated consistently and quickly. Where providers must notify customers, those communications can be orchestrated as part of the same workflow, avoiding duplication, error and delay.
