UK’s Cyber Security and Resilience Bill: What it means and to whom
The forthcoming Cyber Security and Resilience Bill is expected to yield significant changes to the technology landscape of public sector organisations across the UK. Experts from Airwalk Reply outline the Bill’s key measures and impact, and what organisations can do to be ahead of time.
The proposed legislation – outlined in a Government policy statement on 1st April 2025 – aims to significantly expand the UK’s cyber security regulatory framework. The Bill will extend the UK’s cyber security regime and, in many ways, mirrors the EU’s NIS2 Directive, which started applying to businesses in October 2024 as a legal framework to uphold cybersecurity in 18 critical sectors across the European Union.
Who does the Bill impact?
One of the most significant changes brought about by the Cyber Resilience Bill is the expansion of in-scope entities. If ratified, it will extend existing and introduce new requirements for firms associated with the delivery of UK national public services, including:
- Government departments and agencies responsible for delivering essential public services.
- Private sector entities that provide critical infrastructure or outsourced services to the government.
- Regulatory bodies overseeing operational resilience and cybersecurity compliance.
The major shift is the extension by association to private sector organisations, specifically but not exclusively extending to organisations that provide services such as:
- Managed IT services,
- IT infrastructure and applications management,
- IT remote support and systems integration and management (SIAM),
- Managed security service providers (MSSPs),
- Managed secure operations centres (SOC),
- Security information and event management providers (SIEM),
- Incident response and threat and vulnerability management providers,
- Business process outsourcing
In summary, a large section of traditional IT outsourcers and SaaS providers are likely to fall into the scope of this Bill and be required to comply with stipulated measures.
Bill highlights and measures
Introduction of enhanced incident response requirements: In-scope organisations must establish protocols for sharing incident details with the National Cyber Security Centre (NCSC). The aim is to increase the frequency, monitoring and transparency of risks and support service restoration.
Enhancing supply chain resilience risk management: As seen with DORA and FCA regulations in the financial services sector, government bodies and in-scope entities will be required to conduct enhanced due diligence on suppliers, including third-party risk assessments to identify and manage supply chain risk more effectively.
Increasing Cybersecurity and Infrastructure protections: Strengthened cybersecurity standards will be enforced, with penalties for non-compliance available for enforcement. Expectations for failure testing, broader scenario planning and regular reporting will become critical.
Power of enforcement by the Secretary of State: The Secretary of State introduces new powers to direct regulators to advise their sectors to adopt more stringent cyber security measures where necessary for national security.
What happens next?
The Cyber Security and Resilience Bill will be taken forward to parliament in 2025. Further details on effective dates, final details and requirements for firms will subsequently be made available.
Conclusion
The reality is that these new regulatory requirements are likely to yield significant changes across the public sector technology landscape in the years ahead. Specifically, we can foresee major changes in procurement and operational processes, infrastructure, network and security architectures and investments, and an increase in senior-level focus on supply chain and technology resilience.
Don’t get caught out; resilience transformation takes time and involves a multi-disciplined response across Risk, IT, Security and Sourcing. Now is the time to prepare: check out existing Operational Resilience and DORA measures used in financial services, talk to cross-industry peers and start building a plan to transform your end-to-end cyber resilience position.
