Cyber Security and Resilience Bill: the UK law coming for MSPs

The Bill brings medium and large MSPs into scope as Relevant Managed Service Providers. Regulators can also designate smaller MSPs as critical suppliers. Below: where the Bill is, how size is judged, and what to do this quarter.

Current stage: Lords report stage, scheduled to begin on 26 October 2026.

Still to come: Lords third reading, Commons consideration of any Lords amendments, then Royal Assent.

When the duties start: on dates the Secretary of State sets by regulations after Royal Assent. No dates are set yet.

Source: UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill, stages, as published on 22 October 2026. Commencement is clause 60 of the Bill as amended in Grand Committee (HL Bill 49, 7 September 2026).

1. What is the Cyber Security and Resilience Bill?

The Cyber Security and Resilience (Network and Information Systems) Bill is the UK government’s refresh of the existing NIS Regulations 2018. Its purpose is to strengthen the cyber security and resilience of:

• operators of essential services
• relevant digital service providers
• some data centres and managed service providers
• critical suppliers in their supply chains

For MSPs, three things really matter.

A new regulated class: Relevant Managed Service Providers (RMSPs)

Medium and large MSPs may be in scope as “Relevant Managed Service Providers” (RMSPs). Under the government’s definition, managed services means the ongoing management of a customer’s IT systems under contract, delivered by connecting to or accessing their network and information systems.

Small and micro enterprises are generally excluded from the RMSP measure, but can still be designated as a critical supplier if their services are essential to a regulated entity.

Source: RMSP Factsheet

What counts as a managed service

At the DSIT stakeholder session on MSPs and systemic risk (March 2026), two elements appeared central to the definition.

Ongoing management of IT systems.

The Bill is focused on organisations providing continuous operational management of systems, rather than one-off consulting or project work. Examples likely to fall within scope include infrastructure management, patching and maintenance, endpoint management, security monitoring, network management, and system administration.

Contractual delivery of services.

The services must typically be delivered under contract for ongoing management of systems. Providers offering one-off advisory work, consulting services, or implementation projects may fall outside the definition.

Cloud platforms themselves are expected to be handled under separate regulatory regimes, meaning the MSP provisions are focused specifically on service providers managing customer environments.

Direct duties for RMSPs

RMSPs are brought under a NIS-style regime. They are expected to:

• take appropriate and proportionate technical and organisational measures to manage cyber and resilience risk
• report certain significant cyber incidents within defined timeframes
• cooperate with investigations and, if necessary, face enforcement action

Powers to regulate critical suppliers

Regulators gain the power to designate specific suppliers as “critical” where failure or compromise of that supplier could seriously disrupt essential or digital services. That can include smaller MSPs, not just the largest players.

The direction of travel

When you provide managed services into critical sectors, you are treated as part of national infrastructure.

2. Where is the Bill now, and has it been passed?

No. As of 26 October 2026 the Bill is not law. It has cleared every stage in the House of Commons and the House of Lords second reading and committee stages. Lords report stage is scheduled to begin on 26 October 2026.

• Introduced to the House of Commons (12 Nov 2025)
• First reading (a formal stage without debate)
• Second reading passed (6 Jan 2026)
• Committee stage completed (3 to 26 Feb 2026)
• Carried over into the new parliamentary session and reintroduced (14 May 2026)
• Report stage and third reading passed (16 Jun 2026)
• First reading in the House of Lords (17 Jun 2026)
• Lords second reading (14 Jul 2026)
• Lords committee stage in Grand Committee (1, 3 and 7 Sep 2026). The Bill was reprinted with its amendments on 7 Sep 2026
• Now: Lords report stage (scheduled from 26 Oct 2026)
• Next: Lords third reading, then the Commons considers any Lords amendments
• Then: Royal Assent. Parliament has not published a date
• Then: commencement. Most provisions, including the duties on MSPs, start on dates set by regulations

Source: UK Parliament, bill stages

Not law yet, but in its final stages

The Lords can still amend the Bill, and the Commons must agree any changes before Royal Assent. The MSP provisions in the Bill as amended in Grand Committee keep the structure this guide describes: RMSPs registered with and regulated by the Information Commission, incident reporting within 24 and 72 hours, customer notification, and powers to designate critical suppliers.

The MSP question, raised in the Lords (second reading, 14 July 2026)

The line that matters most for our world came from Lord Holmes. One of his key questions to the Minister was this:

“How will the Government ensure that responsibilities across complex digital supply chains are clearly understood, particularly for managed service providers and their clients?”

A member of the House of Lords is asking the government to make MSP responsibilities inside client supply chains clear.

He pushed further on the shape of the requirements, asking the government to ensure the new obligations are “outcome-focused, measurable and operationally realistic,” and that reporting is “clear, practical, proportionate and sector-specific.”

That phrase, operationally realistic, matters for smaller MSPs especially. Nobody wants a regime only the biggest providers can afford to satisfy. Rules a 20-person MSP can meet and evidence, without a full compliance team to run them, matter as much as rules for the biggest providers.

That’s a precise description of the gap most MSPs are carrying right now. The certifications on the wall describe work done once. The direction Lord Holmes is pointing in is work you can evidence when you’re asked, tied to outcomes, in a form a regulator or an insurer would accept.

2a. What RMSPs will be required to do

If you are classed as an RMSP, expect requirements in four practical areas:

Registration

• RMSPs must register with the Information Commission
• Once the RMSP provisions commence, there is a 3 month window to register
• Overseas RMSPs must appoint a UK representative

Security duties

• RMSPs must implement appropriate and proportionate measures to manage risk and minimise impact
• Technical detail is expected to be set out via secondary legislation

Incident reporting and customer notification

• 24 hours: initial notification (light touch)
• 72 hours: fuller report
• NCSC is informed at the same time as the regulator
• RMSPs must also notify customers likely to be affected

Enforcement, fines, and fees

• Stronger enforcement model and higher maximum penalties
• Up to £10 million or 2% of worldwide turnover (whichever is higher) for standard breaches
• Up to £17 million or 4% of worldwide turnover (whichever is higher) for more serious breaches
• Up to £17 million or 10% of turnover (whichever is higher) for failing to comply with a direction
• Up to £100,000 per day for continuing breaches of directions
• Regulators can recover the full costs of their NIS functions via charges and fees

Sources:

• RMSP factsheet
• Incident reporting factsheet
• Enforcement factsheet
• Cost recovery factsheet

What does “secondary legislation and guidance” mean?

The Bill sets the main powers and structure. After it becomes law, ministers can use those powers to make “secondary legislation” (detailed regulations) and publish guidance. That is where the fine detail will live, for example:

• the precise definition of which incidents must be reported and in what format
• detailed security and resilience expectations for RMSPs
• how “critical suppliers” will be identified and designated in practice

3. How government classifies MSP size

To understand whether your MSP is likely to be an RMSP, you need to translate government’s size language into something practical.

The government’s MSP market study and NIS guidance use standard SME bands:

• Micro: fewer than 10 staff and annual turnover up to about €2 million
• Small: fewer than 50 staff and annual turnover up to about €10 million
• Medium: fewer than 250 staff and annual turnover up to about €50 million
• Large: at or above those thresholds

Under the Bill, RMSPs are specifically managed service providers that are not small or micro enterprises. In other words, broadly the medium and large MSPs that meet the managed-services definition.

Quick self-assessment

If you are around 50 or more staff and heading into eight-figure revenue: You should assume you are a candidate RMSP.

If you are smaller than that but deeply embedded in critical or regulated customers: You should assume you are still part of the regulated picture via the supply chain.

Being “small” by this definition doesn’t mean “off the hook”. It just changes how the obligations reach you.

4. Why this matters for every MSP

Only a minority of MSPs will be RMSPs at the start, but the Bill will change expectations across the entire channel. Three reasons.

Supplier questionnaires will get harder

Operators of essential services and relevant digital services are already regulated under NIS. Government has been explicit that weaknesses in MSPs and data centres are a major concern. As those entities respond to the Bill, they will:

• send longer supplier questionnaires about your security and resilience
• insert tougher clauses into contracts and frameworks
• ask for evidence that someone independent has checked

If you serve NHS bodies, utilities, transport, financial services, or large cloud and digital platforms, this will land on your desk sooner rather than later.

You can be designated as a critical supplier

Even if you are small on paper, regulators will be able to designate you as a critical supplier if your services are essential to a regulated entity’s ability to operate. A 20 person MSP that effectively runs the IT and security stack for a hospital, water company or major SaaS provider is a prime example.

The wider direction of travel

Outside the Bill, the NCSC Cyber Assessment Framework (CAF) has become the benchmark for what good looks like for critical functions. NCSC CAF 4.0, the current version, tightens that further and is being referenced more in policy and guidance. Regulators and clients increasingly expect outcome based, evidence backed assurance.

Even if you never receive a formal notice from a regulator, supplier questionnaires and insurer forms will increasingly test you against these expectations.

5. What the Bill asks beyond CAF 4.0

CAF 4.0 sits at the heart of the UK’s approach. It defines outcomes for:

• managing security risk
• protecting against cyber attack
• detecting cyber security events
• minimising the impact of incidents

The Bill builds on that, but it clearly goes beyond “map yourself to CAF 4.0 once and tick a box”.

Under the new regime:

• regulated entities, including RMSPs, must put in place appropriate and proportionate measures to manage risks to the systems they rely on to deliver their services
• they must notify regulators quickly when a significant incident happens (initially, in a matter of hours, not weeks), and follow up with fuller reporting
• regulators have stronger powers to gather information, require improvements and, in serious cases, impose penalties

The practical test for MSPs

Can you show, with evidence, that you are managing risk, protecting systems, detecting and responding to incidents, and learning from them, all year round?

A CAF 4.0 spreadsheet, ISO 27001 certificate or Cyber Essentials badge is helpful, but only if it sits on top of a living system of controls and oversight.

6. Common MSP myths about the Bill

Myth: This is only for big MSPs

Reality: The direct RMSP rules are aimed at medium and large MSPs, but regulators can still designate smaller MSPs as critical suppliers, and regulated customers will expect higher standards from every MSP in their chain.

Myth: We’ll deal with it when it’s actually law

Reality: The Bill is in its final stages in Parliament. Building governance, processes and evidence takes months or years, not days. Waiting means reacting after the questionnaires and regulator requests have arrived.

Myth: We have ISO 27001 or Cyber Essentials, so we’re covered

Reality: Those frameworks remain valuable and recognised. They show a process was in place on the day of the audit. CAF 4.0 and the Bill both look at how controls hold up between audits.

Myth: It is just another audit

Reality: The regime is built around ongoing duties, earlier incident reporting, stronger investigative powers and proportionate enforcement. Regulators will look for patterns in how you operate over time.

7. What should MSPs actually do now?

Here are sensible first moves for any UK MSP.

Do a quick health check against CAF 4.0

Use the four CAF 4.0 objectives as headings and list your strengths and gaps under each. Focus on gaps that would really hurt if a key client suffered a serious incident and your name was in the mix.

Map your client base to criticality

Identify which clients are in essential services, highly regulated sectors, or key digital platforms. Those relationships will feel the new expectations and due diligence first.

Tighten incident response and communication

Create or sharpen an incident response plan that answers: who leads, who makes decisions, who communicates, how you classify incidents and decide what is “significant”, and how quickly and clearly you tell clients what is happening. Design it so that, if you ever need to align to 24-hour / 72-hour reporting expectations, you are not starting from scratch.

Build a real evidence trail

Start collecting and keeping the kind of evidence any serious assessment will expect to see: security and service policies, records of access reviews and change approvals, monitoring logs, and notes from regular security reviews and post-incident reviews. Aim to show you do what you say and improve over time.

Sanity check your contracts and DDQs

Look at the security and resilience promises you make in contracts and due diligence questionnaires. Make sure those claims are realistic and that you could evidence them under pressure. Better to tighten wording now than discover a gap in the middle of an incident.

8. Where Assurix fits

Assurix: the live trustmark for MSPs

Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. The operational controls cover how you run patching, backup, monitoring, incident response and governance day to day. Evidence comes from the tools and systems you already use. Live-measured controls are checked every six hours and the rest on a set cycle. The result sits on a Trust Portal anyone can open. Leave a failure unfixed for 30 days and the Trustmark is suspended publicly.

For an MSP, holding the Assurix Trustmark can deliver several concrete benefits.

Win more deals against less mature competitors

Good MSPs often sound the same as mediocre ones on paper. A live Assurix trustmark independently proves you do what others only claim, from patch compliance to backup success. Its 59 controls include 19 operational controls covering how the MSP runs its service. Little Big Tech saw what that does in a sale. A 22-user pharma company, burned by its previous MSP, had three other MSPs lined up. It chose Little Big Tech and signed the day after one meeting, once founder Nick Haley had explained Assurix, the standard and how Little Big Tech is held to it. He called it “one of the lowest friction sales processes we have ever had with a brand-new prospect.”

Run a more secure, predictable MSP

Assurix tracks your performance against security controls aligned to CAF 4.0 and operational controls built for MSPs. That creates a predictable rhythm of checks, fixes and reviews. An Assurix assessor signs off. A failure opens a 30-day window to fix it. If it isn’t fixed, the Trustmark is suspended publicly.

“I feel confident that we are much more secure going through the Assurix process.”

Ian Groves, MD, Start Tech

Better terms on your own insurance

Insurers and risk committees are tired of self certified questionnaires. A trusted, structured view of your security and operational maturity gives you a stronger hand when discussing cover, terms and pricing. Trustmark holders can get up to 25% off professional indemnity and cyber insurance with partner insurers Hiscox, CFC and Beazley, subject to underwriting.

Build a more valuable business

Demonstrable operational maturity, proven security controls, and live, evidence-based assurance make your MSP easier to grow and eventually sell. Acquirers and investors value transparent processes, predictable operations, and verified compliance that does not depend on heroics or tribal knowledge.

9. What is known vs what is still to be confirmed

Known now

• RMSPs are being brought into scope of the NIS regime
• The regulator for RMSPs is the Information Commission
• Incident reporting shifts to 24 hour initial, 72 hour full reporting, and customer notification expectations
• Maximum penalties: up to £10 million or 2% of worldwide turnover for standard breaches, up to £17 million or 4% of worldwide turnover for more serious breaches, up to £17 million or 10% of turnover for failing to comply with a direction, and up to £100,000 per day for continuing breaches of directions
• RMSPs must register with the Information Commission within 3 months of the RMSP provisions coming into force
• As of 26 October 2026 the Bill is at House of Lords report stage. It is not law yet

Still to be confirmed via secondary legislation and consultation

• Detailed technical requirements and thresholds for what counts as a significant incident
• The full detail of reporting thresholds and templates
• Fee levels and charging schemes per regulator
• The dates each part of the Bill comes into force, which are set by regulations after Royal Assent

One open concern: regulatory duplication

A recurring theme at the DSIT session was concern about overlapping regulation. There are currently around a dozen different regulators involved in cyber oversight across sectors. Industry stakeholders raised concerns about duplicated reporting requirements, multiple regulatory fees, conflicting expectations, and administrative complexity.

As a result, many organisations are pushing for clear coordination between regulators or a single lead regulator model. How this will ultimately be implemented remains an open question.

10. More on the Bill

You do not need to wait for every regulation and guidance note to be finalised before you act. These cover the parts of the Bill this guide only touches on:

• The Bill for UK businesses: the version written for your clients, the businesses that use an MSP.
• MSPs that support Critical National Infrastructure: CNI and near CNI clients, and what they expect.
• NIS2 for UK MSPs: when EU rules reach a UK MSP.
• NCSC CAF 4.0 for MSPs: the objectives, principles and outcomes, and how to use them before you are asked.
• NGage podcast with Mit Patel: the Bill, the NCSC Cyber Assessment Framework and Cyber Essentials, in conversation.