Last year, British boardrooms learned an expensive lesson about cyber risk. The Cyber Security and Resilience Bill now going through Parliament is the result.
Marks & Spencer said its cyberattack would cost around £300 million in operating profit (ESM Magazine). The Co-op reported about £206 million in lost revenue after shutting down systems to contain its own attack (Infosecurity Magazine). Then Jaguar Land Rover's factories stopped for more than a month, in an incident the Cyber Monitoring Centre estimated cost the UK economy £1.9 billion and affected around 5,000 businesses, likely the most economically damaging cyber event in the country's history (Silicon UK).
The common thread was not just criminals. It was how deeply modern organisations depend on suppliers, and how quickly a problem in one place spreads through a whole chain.
Parliament's answer is the Cyber Security and Resilience Bill. It is now in the House of Lords, and it is going to change what organisations expect from their technology suppliers.
Where the bill is now
The bill had its Lords second reading on 14 July, and committee stage began on 1 September (UK Parliament). Report stage is scheduled for 26 October. Royal Assent is expected between late 2026 and spring 2027, with many of the detailed duties arriving later through secondary legislation (Cyber Security and Resilience Bill tracker).
In other words, the direction is set and the detail is still forming. That is exactly the right moment to prepare.
What changes
The bill updates the UK's Network and Information Systems regime in three ways that matter most to boards (Travers Smith).
Managed service providers come into scope. Medium and large firms that manage IT systems on an ongoing basis for other organisations become "relevant managed service providers", with their own security and reporting duties. Micro and small firms are excluded.
Critical suppliers can be designated. Regulators will be able to bring specific suppliers directly into the regime where a disruption to them would have a significant impact on the economy or daily life. The supply chain becomes regulated, not just the organisations at the top of it.
Incident reporting gets faster. Regulated organisations will need to notify their regulator and the National Cyber Security Centre within 24 hours of a significant incident, followed by a full report within 72 hours. Near misses capable of significant impact may also need reporting.
Why this matters even if you are not regulated
Many organisations will read this and conclude it is a problem for energy companies, hospitals and water firms. That would be a mistake.
If you supply services to anyone in scope, expect your contracts to change. Customers will pass the 24-hour clock down the chain, because they cannot report what their suppliers have not told them. And if you buy managed IT services, your provider is likely to be regulated directly, which will raise the baseline you can reasonably expect from them.
The bigger point is that the bill reflects how attacks actually work now. Last year's incidents showed that the weakest link is often a supplier, a help desk or a third-party system. Regulation is simply catching up with that reality.
Five questions to ask your suppliers this quarter
You do not need to wait for Royal Assent. Start with the providers who run or support your most critical systems:
- How quickly will you tell us about an incident affecting our services, and through what channel?
- Could you support us in meeting a 24-hour notification requirement, with the facts we would need?
- Who are your own critical sub-suppliers, and how do you manage their risk?
- When did you last test recovery of our systems, and what did you learn?
- Do you expect to be a relevant managed service provider under the bill, and what are you changing as a result?
The quality of the answers will tell you a great deal. Vague responses are a signal to review the relationship, the contract or both.
And look in the mirror
Can your own organisation meet a 24-hour reporting clock? That means knowing quickly that something has happened, who decides it is significant and who makes the call to the regulator. Most incident plans were written for a 72-hour world. Run a tabletop exercise this year using a realistic supplier-originated scenario and see where the clock runs out.
Our Managed Services practice is built around keeping critical applications healthy once they are live. If you want help reviewing supplier resilience, incident readiness or the contracts that sit behind them, talk to us. For a related threat in the software supply chain, read our note on hardening against npm and open source attacks.
Frequently asked questions
What is the Cyber Security and Resilience Bill?
It is UK legislation that updates the Network and Information Systems regime, bringing managed service providers and designated critical suppliers into scope and tightening incident reporting requirements.
When will the Cyber Security and Resilience Bill become law?
The bill is in the House of Lords, with report stage scheduled for 26 October 2026. Royal Assent is expected between late 2026 and spring 2027, with detailed duties following in secondary legislation.
What are the incident reporting deadlines under the bill?
Regulated organisations will need to notify their regulator and the NCSC within 24 hours of a significant incident and provide a full report within 72 hours.
Sources
- Britain's M&S says cyberattack to cost £300m — ESM Magazine, 22 May 2025
- Co-op records £206m revenue loss following cyber-attack — Infosecurity Magazine, 25 September 2025
- Jaguar Land Rover attack costs UK estimated £1.9bn — Silicon UK, 23 October 2025
- Cyber Security Bill debated in the Lords — UK Parliament, 15 July 2026
- Cyber Security and Resilience Bill Lords report stage — CSRB tracker, 29 September 2026
- The UK's new Cyber Security and Resilience Bill — Travers Smith, 19 November 2025