The Cyber Security and Resilience Bill, the government’s update to the UK’s rules for network and information systems, is scheduled to return to the House of Lords for its report stage on 26 October.
The Bill cleared the House of Commons in June and was debated in Grand Committee in the Lords from 1 September. Report stage is the first point at which the whole House can vote on changes. The Bill then needs a third reading, and MPs must consider any Lords amendments, before Royal Assent, which the law firm Gowling WLG has said may come towards the end of this year.
Who the Cyber Security and Resilience Bill covers
The Bill isn’t intended to regulate every business. It focuses on operators of essential services and critical national infrastructure, certain digital services, and the organisations that support them through their supply chains. Relevant managed service providers, the firms that run IT on behalf of other organisations, would be brought into scope, although micro and small businesses (fewer than 50 staff and turnover of up to €10 million) are excluded from that definition. Regulators would also gain powers to designate critical suppliers.
It would also strengthen incident reporting. Under the Bill as introduced, organisations in scope would have to notify their regulator and the NCSC of an incident within 24 hours, followed by a full report within 72 hours. Further detail, including which incidents must be reported, is expected in secondary legislation and guidance.
What it means for smaller businesses
Most small firms won’t be regulated directly. The effect is more likely to reach them through their customers: organisations in scope will need assurance about the suppliers they depend on, which usually means security questionnaires, evidence of controls and questions about incident plans.
Gowling WLG’s advice to businesses includes briefing the board on cyber risk, reviewing critical suppliers and contracts, testing incident response plans and assessing how AI affects fraud and identity risks. It also points to the NCSC’s Cyber Essentials scheme, its Cyber Assessment Framework and its free Early Warning service.
How we help
Universal Computing’s cybersecurity work is aligned with Cyber Essentials best practice, and if you’re working towards Cyber Essentials, or need to answer a customer’s or insurer’s security questions, we can help you prepare. Our ongoing staff training, malware protection and monitored backups, with a plan for the worst day, cover the areas customers most often ask about.
Book a free security review, or read about our cybersecurity services.
