West Midlands Cyber
The West MidlandsCyber Cluster
Join the Cluster

Cyber Security and Resilience Bill

Changes to the UK’s resilience regime extend obligations across data centres, managed service providers and critical suppliers. We examine the implications for organisations and their supply chains.

Contents

Table of Contents

The Cyber Security and Resilience Bill: What It Means for the West Midlands

The Cyber Security and Resilience Bill represents a substantial change in the UK’s approach to cyber regulation. Rather than replacing the Network and Information Systems Regulations 2018 with an entirely new regime, the Bill extends and strengthens the existing framework, bringing additional digital infrastructure and technology providers within scope while creating mechanisms to regulate suppliers whose failure could materially affect essential services.

The change reflects the structure of the modern economy. Organisations providing essential services increasingly depend on data centres, managed service providers, cloud platforms, software, specialist technology companies and complex supply chains. Cyber resilience can therefore no longer be regulated effectively by concentrating solely on the organisation delivering the final service. Dependencies elsewhere in the system can be equally consequential.

The originating analysis, The UK Cyber Security and Resilience Bill 2025: What It Means and Why It Matters, argued that the Bill should be understood as a move from relatively narrow sector-based cyber regulation towards a broader national resilience framework. That assessment remains useful, but the implications are now clearer. The Bill was introduced to Parliament on 12 November 2025, and the Government’s supporting material has subsequently been updated as it has progressed through Parliament. It remains a Bill rather than enacted legislation at the time of writing, so organisations should distinguish between the direction of policy and obligations already in force.

For the West Midlands, the significance extends beyond organisations that will become directly regulated. The region’s manufacturing, infrastructure, technology and professional-services supply chains contain businesses whose importance to customers can be much greater than their size would suggest. As regulation becomes more concerned with dependency, cyber capability increasingly becomes relevant not only to compliance but to procurement, supplier relationships and operational resilience across the regional economy.

What does this mean for your business? The West Midlands Cyber Hub explains how the Cyber Security and Resilience Bill could affect organisations directly or indirectly through customers, suppliers and digital-service relationships, in the companion article “Could the Cyber Security and Resilience Bill Affect Your Business?”.

Key Takeaways

  • The Bill expands the existing NIS framework towards data centres, relevant managed service providers, large load controllers and critical suppliers, reflecting the growing importance of technology and supply-chain dependencies.
  • Criticality increasingly depends on the consequences of disruption rather than simply the size or sector of an organisation, meaning some suppliers may become strategically important because of the services on which customers rely.
  • Proposed incident-reporting requirements create operational demands as well as compliance obligations because regulated organisations need the capability to identify, assess and escalate qualifying incidents quickly.
  • The effects will extend beyond organisations directly within statutory scope as regulated customers strengthen supplier assurance and contractual cyber requirements.
  • For the West Midlands, the principal implementation challenge will be helping organisations understand where they sit within critical supply chains and develop proportionate capability before customer or regulatory requirements become urgent.

The Regulatory Perimeter Is Moving Towards Dependency

The original NIS Regulations concentrated on operators of essential services in sectors including energy, transport, health, drinking water and digital infrastructure, together with specified digital service providers. That model established an important cyber regulatory baseline, but the technology environment has changed substantially since the regulations came into force in 2018.

Essential services increasingly depend on organisations outside the traditional regulatory perimeter. A managed service provider may administer systems for multiple customers. A data centre can host infrastructure supporting numerous services simultaneously. A specialist supplier may provide a technology or capability whose failure creates disruption far beyond the supplier itself.

The Cyber Security and Resilience Bill responds by widening the range of organisations capable of falling within the NIS regime. Government material identifies data centres, relevant managed service providers and large load controllers among the additional categories being brought into scope, while a new critical-supplier mechanism is intended to address important dependencies within regulated supply chains.

This is an important conceptual development because it moves regulation closer to the actual architecture of digital dependency.

Traditional sector classifications remain necessary because consequence is concentrated in areas such as health, energy and transport. They are no longer sufficient on their own, however, when an essential operator’s ability to function can depend upon a technology supplier sitting outside that sector.

For businesses, the relevant question therefore becomes broader than whether their primary industry is regulated. They also need to understand what services they provide to regulated organisations and what operational consequences could follow if those services became unavailable or compromised.

Criticality Is Not the Same as Organisational Size

The critical-supplier provisions are particularly significant for supply-chain economies because they challenge the assumption that only large organisations create systemic cyber risk.

A supplier can be relatively small while occupying a strategically important position. It might provide specialised software, maintain operational equipment, administer customer systems or possess knowledge that cannot easily be replaced. If several important organisations depend upon that capability, disruption to the supplier can have consequences disproportionate to its revenue or headcount.

The Bill provides for competent authorities, or the Information Commissioner’s Office where relevant, to designate certain suppliers as critical where disruption could significantly affect essential, digital or managed services. The policy therefore recognises dependency as a regulatory concern in its own right.

That principle has obvious relevance to the West Midlands. Industrial supply chains contain highly specialised engineering, technology and service companies, many of which operate as SMEs. Some possess capabilities embedded deeply within customer operations even though they would not normally be described as critical infrastructure operators.

Not every such company will become a designated critical supplier, and it would be misleading to suggest otherwise. The wider implication is nevertheless important: organisations need a better understanding of their position within customers’ dependency chains.

For boards, this changes the framing of cyber risk. The question is no longer simply how damaging a cyber incident would be to the organisation itself. It is also how the organisation’s failure could affect customers and whether those consequences create contractual, assurance or regulatory expectations.

Managed Service Providers Illustrate Concentration Risk

The proposed treatment of relevant managed service providers demonstrates why this approach has become necessary.

Managed service providers can hold privileged access to customer environments, administer important infrastructure and provide services that customers cannot rapidly reproduce internally. A compromise affecting one provider can therefore create potential pathways into several organisations or interrupt services across multiple customers.

Government explicitly identifies managed service providers as one of the routes increasingly exploited by cyber attackers and as a reason for expanding the regulatory perimeter.

This is a different type of risk from the compromise of a conventional individual supplier. The concern is concentration. Where many organisations rely upon the same technology provider, the consequences of failure can aggregate.

The principle applies beyond MSPs. Cloud platforms, identity services, software suppliers and other shared digital infrastructure can all create concentrations of dependency, although their precise regulatory treatment varies.

For organisations purchasing these services, supplier governance consequently needs to become more discriminating. Counting suppliers or issuing generic security questionnaires is unlikely to reveal where operational risk actually resides. Businesses need to identify which suppliers possess privileged access, host important data, support essential processes or would be difficult to replace during disruption.

The Bill reinforces that shift from generic third-party management towards dependency-led resilience.

Incident Reporting Becomes an Operational Capability

The Bill also strengthens the incident-reporting framework. Government proposals establish a structured reporting process for qualifying incidents, with an initial notification expected within 24 hours and a fuller notification within 72 hours. The regime is also intended to broaden the circumstances in which incidents are reportable and improve information sharing between regulators and the NCSC.

These timelines are sometimes presented primarily as compliance requirements. Their more important implication is operational.

An organisation cannot report effectively within a compressed timeframe unless it can recognise that something significant has happened. It needs sufficient monitoring and internal reporting to identify the incident, established governance for escalation, an understanding of affected services and dependencies, and people authorised to make decisions while technical investigation is still developing.

Reporting obligations therefore expose weaknesses that may previously have remained internal.

A business with no formal incident-response plan cannot create mature incident-management capability simply because a regulatory clock has started. Responsibilities, communications routes, decision thresholds and evidence preservation need to have been considered beforehand.

The 2025/26 Cyber Security Breaches Survey shows why this could be challenging across the wider business population. Only 25% of businesses had a formal incident-response plan. Capability varied substantially with size, reaching 57% among medium-sized businesses and 76% among large businesses but only 21% among micro businesses.

The Bill will not directly regulate all of those organisations. The figures nevertheless demonstrate the capability environment within which an expanded resilience regime will operate.

Customer Communication Raises the Consequence of an Incident

The proposed reporting regime also reflects the fact that cyber incidents can affect customers as well as regulators.

Where a significant incident is likely adversely to affect the provision of a service, the Bill’s framework can require regulated organisations to notify affected recipients. This makes incident preparedness partly a communications and commercial-governance problem rather than a task confined to security teams.

The distinction matters because organisations frequently have incomplete information during the early stages of an incident. Technical teams may still be establishing the cause and extent of compromise while management needs to determine whether services are affected and what customers should be told.

Preparedness therefore requires more than an incident-response document. Organisations need decision-making structures capable of operating under uncertainty.

For suppliers, the commercial implications can be substantial. Customers increasingly want to know how quickly a supplier will disclose incidents, what information will be provided and how service continuity will be maintained. Contractual incident-notification requirements may in some cases be more demanding than statutory thresholds.

The regulatory direction therefore reinforces a trend already visible in commercial relationships: incident management is becoming evidence of supplier maturity.

Supply-Chain Assurance Will Extend the Bill’s Reach

One of the most important implications for the regional economy is that the Bill’s practical reach is likely to be wider than its direct regulatory perimeter.

Regulated organisations need confidence in the dependencies on which their essential services rely. As their own responsibilities become more explicit, they have stronger incentives to scrutinise suppliers, introduce contractual requirements and seek evidence that appropriate security controls are operating.

The Cyber Security Breaches Survey suggests that supplier-risk management has substantial room to develop. In 2025/26, only 15% of businesses reviewed cyber risks associated with immediate suppliers and 6% considered their wider supply chain. Among large businesses, however, immediate supplier assessment reached 48%.

The disparity matters because larger organisations are more likely to establish requirements that subsequently reach smaller suppliers.

For West Midlands SMEs participating in manufacturing, defence, infrastructure or public-sector supply chains, the relevant consequence may therefore arrive through procurement before it arrives through regulation. A customer may require certification, evidence of incident preparedness, security policies, vulnerability management or more detailed assurance as part of a contract.

This creates an important distinction between being regulated and being affected by regulation.

The population in the second category can be considerably larger.

Proportionality Will Determine the Burden on Smaller Suppliers

Expanding cyber regulation towards dependencies creates an unavoidable proportionality problem.

Where a smaller organisation genuinely creates significant systemic risk, its size cannot provide a reason to ignore that risk. Customers relying on a critical service need appropriate assurance regardless of whether the provider employs fifty people or five thousand.

The resources available to those organisations nevertheless differ substantially.

Large enterprises can distribute cyber responsibilities across security, technology, legal, risk, compliance and operational teams. Smaller providers may have only a handful of people capable of interpreting regulatory requirements while simultaneously delivering the service on which customers depend.

This makes proportional implementation essential. The objective should be equivalent confidence in resilience where consequences justify it, not identical organisational structures.

The Government estimates that the legislation will cost businesses and other stakeholders less than £150 million annually. That aggregate figure is useful for assessing the regime as a whole but cannot describe how costs will be distributed between individual organisations.

For a smaller specialist provider, expenditure on monitoring, governance, external advice, testing and regulatory engagement can represent a materially different proportion of operating costs from the same activities within a large enterprise.

Implementation guidance, consistent regulatory expectations and access to appropriate specialist support will therefore influence whether the Bill improves resilience efficiently or creates avoidable compliance friction.

Regulation Is Becoming More Adaptable

Another significant feature of the Bill is its attempt to prevent the regulatory framework becoming fixed around today’s technology landscape.

Government proposes powers allowing elements of the regime to be updated through secondary legislation, including the ability to bring additional sectors into scope or modify security requirements as threats and dependencies change. The rationale is that cyber risk evolves faster than a regulatory framework dependent entirely on new primary legislation can easily accommodate.

There is a clear practical argument for that flexibility. The significance of managed services, cloud infrastructure and other shared technology dependencies has changed substantially since the original NIS framework was designed.

Adaptability also increases the importance of regulatory predictability. Businesses making long-term investments need sufficient clarity about the direction of requirements, particularly where implementation involves infrastructure changes, specialist recruitment or new assurance processes.

The challenge is therefore to combine agility at system level with reasonable certainty at organisational level.

For regional businesses, this reinforces the value of treating regulatory awareness as a continuing capability rather than a one-off compliance exercise. Organisations operating in strategically important supply chains need mechanisms for identifying changes early enough to assess their consequences before customers or regulators require immediate action.

Stronger Enforcement Changes the Economics of Compliance

The Bill also strengthens the mechanisms available to regulators and is intended to make the regime more sustainable through cost recovery and enhanced enforcement arrangements. Government’s supporting material presents these measures as necessary to ensure regulators have the resources and powers required to oversee increasingly important cyber-resilience obligations.

The economic effect is to make cyber governance harder to treat as discretionary where an organisation falls within scope.

That does not mean compliance expenditure and cyber resilience are synonymous. An organisation can satisfy documentary requirements while remaining operationally vulnerable, just as a technically capable organisation can struggle to produce evidence in the form expected by a regulator.

The strongest implementation should align the two. Risk assessment, incident planning, monitoring and supplier governance should improve operational resilience while simultaneously producing evidence that regulatory obligations are being managed.

Where those processes diverge, businesses can incur substantial compliance costs without achieving an equivalent reduction in risk.

This is one reason practitioner involvement matters. Translating statutory requirements into controls that work within actual technology and operational environments is a different task from interpreting the legislation itself.

The West Midlands Needs an Implementation Response, Not a Regional Regulatory Regime

The Bill strengthens the case for regional cyber capability, but not for regional regulation.

National consistency remains important. Organisations operating across several parts of the UK should not face competing regional interpretations of common cyber requirements, and authoritative technical standards should continue to come from national bodies and relevant regulators.

The regional opportunity lies in implementation.

West Midlands businesses need access to people capable of interpreting how national requirements apply to manufacturing, operational technology, managed services and complex supply chains. SMEs may need support understanding customer assurance requirements before those requirements become barriers to procurement. Organisations potentially exposed to stronger reporting expectations need opportunities to develop and exercise incident-response capability.

Cyber providers can meet part of that demand. Universities can contribute specialist research, testing and skills. Larger regional organisations can improve resilience by making supplier requirements clearer and more proportionate. Cluster and hub infrastructure can reduce the friction involved in connecting these capabilities.

This also creates an economic opportunity for the regional cyber sector. Expansion of the resilience regime is likely to increase demand for risk assessment, assurance, incident preparation, supplier governance, security testing and specialist technical services. The opportunity is strongest where providers can demonstrate practical capability rather than simply reposition existing services around new regulatory terminology.

The regional objective should therefore be dual: reduce the implementation burden for organisations affected by changing cyber requirements while enabling credible West Midlands cyber providers to capture the demand those requirements create.

From Compliance Boundary to Economic Resilience

The Cyber Security and Resilience Bill matters because it changes the way the regulatory system understands cyber dependency. Essential services no longer sit inside defensible organisational boundaries. They depend on data infrastructure, technology providers, managed services and specialist suppliers whose failure can propagate through the economy.

Bringing those dependencies more explicitly within the resilience framework is therefore a logical development. It also makes implementation harder.

The critical question for West Midlands businesses is not simply whether they appear on a list of organisations directly regulated under the eventual legislation. They need to understand whether customers depend materially on their services, whether they themselves depend on suppliers whose failure could interrupt operations, and whether they can identify and manage a significant cyber incident quickly enough to meet increasingly demanding expectations.

For larger organisations, that requires better visibility of critical dependencies rather than undifferentiated supplier assessment. For smaller suppliers, it requires proportionate routes to assurance and incident preparedness. For the regional cyber sector, it creates demand for capabilities that translate regulation into operational resilience.

The Bill provides stronger statutory architecture, but legislation cannot determine the maturity of every organisation within the systems it seeks to protect. Its effectiveness will depend on whether regulatory authority is matched by implementation capacity throughout the economy.

That is where the West Midlands has a material stake in the outcome. In an economy characterised by interconnected industrial and technology supply chains, cyber resilience is becoming part of the infrastructure required to remain a trusted supplier, maintain operational continuity and participate in markets where dependency itself increasingly determines the standard of security expected.