NOT YET LAW. This article reflects the Bill as it stood on 28 October 2026. Its provisions may change before Royal Assent.
The Cyber Security and Resilience (Network and Information Systems) Bill is the biggest update to UK cyber law since the NIS Regulations 2018. It was introduced on 12 November 2025, cleared the House of Commons in June 2026, and began its report stage in the House of Lords on 26 October 2026. Royal Assent is expected towards the end of 2026, although some trackers think it could slip to spring 2027, and much of the detail will follow in secondary legislation.
Most small businesses won’t be regulated directly. But many will feel it through their customers, because the Bill is built around supply chains.
Why the government is acting
The NCSC reported 204 nationally significant cyber attacks in the year to September 2025, up from 89 the year before. Meanwhile, government survey data shows fewer than half of large businesses reviewed the cyber security risks posed by their immediate suppliers.
What the Bill covers
- Data centres are brought into scope.
- Medium and large managed service providers, such as firms providing IT outsourcing, managed security, or cloud hosting, are regulated for the first time. Small and micro businesses are excluded.
- Regulators get powers to designate critical suppliers to essential services. The government’s examples include businesses supplying diagnostics to hospitals or chemicals to water companies.
- Incident reporting gets faster. Regulated organisations must notify their regulator and the NCSC within 24 hours of a significant incident, followed by a full report within 72 hours.
- Data centres and managed and digital service providers must tell customers who are likely to be affected by an incident.
Why it matters if you’re a small supplier
Even if you’re never designated, your customers in sectors such as energy, water, health, transport, and digital infrastructure will be under pressure to show they’re managing supply chain risk. That pressure travels down the chain. Expect:
- longer security questionnaires at tender and contract renewal
- contract clauses requiring you to report incidents to them within hours, not days
- requests for evidence such as Cyber Essentials or ISO 27001 certification
- assurance checks on how you protect their data and any access you have to their systems
What to prepare now
- Know your exposure. List the customers who run essential services or provide managed IT, and what access you have to their systems or data.
- Get the basics certified. Cyber Essentials, or Cyber Essentials Plus, is the baseline many buyers already ask for, and the government has published a supply chain playbook encouraging larger organisations to require it.
- Consider ISO 27001 if you handle sensitive data or systems for larger customers. ISO/IEC 27001:2022 Annex A includes controls on supplier relationships (5.19 to 5.23) and on incident management (5.24 to 5.28), which line up closely with what customers in scope will be asking for.
- Test your incident response. Could you spot, assess, and tell a customer about a serious incident within 24 hours? Run a table-top exercise and fix whatever it shows up.
- Check your own suppliers. If an outside provider manages your IT, ask how they protect you and how quickly they’d tell you about an incident.
- Put someone senior in charge. Cyber risk should be owned by a director or senior manager, not left to whoever is good with computers.
None of this depends on the final wording of the Bill. It’s the evidence buyers are already starting to ask for, and it’s far easier to put in place now than under contract pressure later.
CAW Consultancy helps small businesses achieve ISO 27001 certification and put practical supplier and incident controls in place. Our plain-English guides to ISO 27001 and cybersecurity basics for SMEs are a good place to start, or call 01257 824481 or email Craig@cawconsultancy.co.uk.
Related reading
- Data Breach Response: Your First 72 Hours Under GDPR
- ISO 22301 in Plain English: Business Continuity That Actually Works When Things Go Wrong
- Cybersecurity Basics for SMEs: What Every Small Business Needs
How we can help
If a customer has told you you’re one of their critical suppliers, I can help you put proportionate controls in place. CAW Consultancy prepares small businesses for ISO 27001 certification, starting with a gap analysis against what you already do.
About the author
Craig Willetts, lead auditor with over 20 years’ experience across 20+ ISO standards and UK security schemes. I founded CAW Consultancy to help UK businesses get ready for ISO certification and accreditation, in plain English and without the jargon. My team prepares you for your audit, and your chosen certification body carries it out. Connect with me on LinkedIn or visit CAW Consultancy.
Leave a Reply