Preparing for the UK Cyber Security and Resilience Bill takes three steps. First, map which of your services and suppliers fall in scope. Second, build an incident process that can meet 24-hour and 72-hour reporting. Third, connect cyber, supplier, and continuity risk in one system.
LogicGate links these programmes so evidence, owners, and deadlines sit in one place. As the Bill progresses through Parliament, organisations should establish a baseline around its core mandates and continuously monitor emerging amendments.
Where Does the Cyber Security and Resilience Bill Stand Today?
The Cyber Security and Resilience (Network and Information Systems) Bill originated in the House of Commons and is currently in the House of Lords. Parliament confirmed its Lords Report Stage started on 26 October 2026. That followed its 12 November 2025 introduction, 14 July 2026 Second Reading, and early September Committee Stage.
At Committee Stage, the Government tabled amendments creating a new vendor direction power. It would let the Secretary of State direct in-scope entities about vendor-supplied goods or services that could create national security risks.
Amendments put forward on day one of Report Stage cover several topics:
- Reporting of incidents involving frontier AI models
- Voluntary notification of incidents, cyber threats, and near misses
- Maintaining a Digital Sovereignty Strategy
- A requirement for large businesses to report on cyber security and resilience plans
These are proposals, not settled law, so final wording will only be clear once the Lords finish and the Commons considers any changes.
What Does the Bill Change for Regulated Organisations?
The Bill amends the Network and Information Systems (NIS) Regulations 2018 rather than replacing them. Four changes matter most for risk and compliance teams.
Which Organisations Come Into Scope?
Managed service providers and data centres are brought into the regime under the Bill, which also allows for critical suppliers to be designated. Meanwhile, relevant digital service providers and existing operators of essential services remain covered.
Parliament describes the Bill as integrating additional sectors and giving government powers to instruct organisations in the interests of national security. Scope details may still shift during the Report Stage.
What Are the New Incident Reporting Deadlines?
The government’s incident reporting policy paper describes a two-stage process. An initial notification goes to the regulator within 24 hours of becoming aware of an incident, followed by a comprehensive report within 72 hours.
The National Cyber Security Centre (NCSC) is also informed at the same time as the regulator. Law firm Clifford Chance notes that the trigger widens to incidents that are capable of having an adverse effect, not only those that did.
How Large Could Penalties Become?
The government’s enforcement policy paper sets a higher maximum of £17 million or 4% of worldwide turnover, whichever is greater, for serious breaches. Less serious breaches carry a lower band of £10 million or 2% of turnover.
Law firm analysis describes daily fines of up to £100,000 for ongoing contraventions. These figures mean that turnover-based fines move cyber compliance into the boardroom.
Use Cyber Risk Quantification (CRQ) to move beyond red/yellow/green heat maps. Translating vulnerabilities into actual financial exposure (e.g., a £5 million risk vs. a ‘High’ risk) helps secure board budget for remediation before an incident happens.
What Is the Vendor Direction Power?
This power puts supplier decisions on the compliance agenda. Teams will need to know quickly which systems depend on which vendors. Flat spreadsheets cannot map the complex web of nth-party concentration risk. Using a relational GRC platform like LogicGate connects vendors directly to your critical assets, allowing you to instantly identify single points of failure hidden deep in your supply chain.
How Should Organisations Prepare Before Royal Assent?
The timing of Royal Assent is uncertain, but the core duties are clear enough to act on. Five steps give teams a head start.
- Confirm your scope. Check whether you are an operator of essential services, a digital service provider, a managed service provider, or a data centre. Document your reasoning and the services affected; revisit it as amendments pass.
- Rehearse the 24-hour clock. Run a tabletop exercise that starts the clock at first awareness. Test who decides an incident is reportable, who drafts the notification, and who contacts the regulator and NCSC.
- Map supplier dependencies. List suppliers by the services they support. Flag managed service providers and any vendor whose failure would disrupt a regulated service.
- Build evidence continuously. Regulators will want proof that controls work, not only policies. Assign control owners and collect evidence on a schedule.
- Track the amendments. Watch AI incident reporting, near-miss notification, and vendor directions. Keep a register of open changes and their likely impact.
How Can LogicGate Help Manage Readiness for the Bill?
LogicGate, the Leading AI GRC Platform for the Enterprise, connects cyber risk, third-party risk, and continuity planning in one architecture. It supports all three areas of the Bill’s duties. Vendor findings roll up into enterprise-wide risk registers, so supplier issues appear next to cyber and operational risk.
The LogicGate platform is no-code, so risk teams can change workflows without waiting on IT and stay ready when the final text lands and requirements shift. GRC Lifecycle Management syncs production to a development environment, so teams can test changes before they go live.
| Readiness Need | Risk Cloud Capability | What Your Team Still Owns |
|---|---|---|
| Scope and asset visibility | Cyber Risk Management links controls to assets and assets to risks | Scope decisions |
| Supplier dependencies | Third-Party Risk Management with a generally available GRC Agent | Supplier risk acceptance |
| Continuous evidence | Automated Control Testing checks uploaded evidence and returns pass, fail, or incomplete with a rationale | Validating results |
| Incident procedures and continuity | Policy and Procedure Management documentation of incident management, and BCM to define recovery plan | Defining processes and initiating recovery plans |
| Near-miss tracking and proactive remediation | The Incident Management application captures near-miss data to identify failing controls and trigger automated remediation workflows | Setting near-miss definitions and action thresholds |
| Board & Executive Reporting | Executive Dashboards & Cyber Risk Quantification (CRQ) translate cyber risk into financial terms | Defining risk appetite and presenting the narrative to the Board |
Determining whether an incident requires reporting remains entirely the responsibility of your organisation. By maintaining clear visibility across task owners, supporting evidence, and key deadlines, the platform empowers your team to respond with greater speed and efficiency.
LogicGate can further support with the newly released Cyber Risk Agent and the Incident Management Agent, planned for Fall 2026.
To see how connected risk architecture supports regulatory change like this, request a LogicGate demo.
FAQ: What Do Teams Ask Most About the Bill?
Is the Cyber Security and Resilience Bill Law Yet?
No. The Bill is at Report Stage in the House of Lords. It still needs further Lords stages, any Commons consideration of amendments, and Royal Assent.
Who Must Comply With the Bill?
Operators of essential services and relevant digital service providers stay in scope. Managed service providers and data centres are added, and critical suppliers can be designated. Check the latest text for your sector.
What Are the Incident Reporting Deadlines?
The Bill proposes an initial notification within 24 hours and a full report within 72 hours. Both go to the regulator, and the NCSC is informed at the same time. Regulators will scrutinize your timeline. Managing the 24 hour reporting window via email creates liability. LogicGate provides a defensible audit trail and an immutable timestamped record to prove your exact compliance.
How Does the Bill Compare With NIS2?
Both share themes such as wider scope, supply chain focus, tougher penalties, and faster reporting. Travers Smith notes that NIS2 covers more sectors, 18 in total. Given the shared themes across both regimes, organizations shouldn’t treat them as entirely separate projects. Mapping your controls to a global framework (like NIST or ISO 27001) allows your team to ‘test once, comply many’ and seamlessly overlap your UK Bill, NIS2, and DORA efforts without duplicating work.
Can Software Make My Organisation Compliant?
No. Software supports the process by organising scope, suppliers, evidence, and deadlines. Your team still makes the judgments and owns the accountability.
This post is general information, not legal advice. Check the current Bill text and speak with counsel about your obligations.
