The Cyber Security and Resilience Bill: what it means for your suppliers and IT services

The UK's Cyber Security and Resilience Bill is the biggest update to the country's network and information systems rules since 2018. Its headline is cyber security, but its practical impact lands on supplier management, service operations and incident response — the parts of the organisation that are often governed least tightly.

At the time of writing (November 2026), the Bill is in its final parliamentary stages. Secondary legislation and regulator guidance will settle much of the detail, but the direction is already clear enough to act on.

What the Bill changes

The Bill updates the existing NIS Regulations. The changes most relevant to transformation and IT leaders are:

• Managed service providers come into scope. Providers of managed IT services to in-scope organisations face security and reporting duties of their own.
• Critical suppliers can be designated. Regulators gain powers to bring suppliers whose disruption would have a significant impact into the regime, even where they are not operators of essential services themselves.
• Incident reporting is faster and broader. Significant incidents must be notified quickly — an initial notification within 24 hours and a fuller report within 72 hours — including incidents that could have caused disruption, not only those that did.
• Data centres are brought into scope as essential infrastructure.
• Regulators gain stronger powers to recover costs, gather information and enforce.

For many organisations, the most significant effect is indirect: your supply chain will be asked to evidence resilience, and so will you.

Why this is a supplier governance problem

Most significant incidents in complex estates start with, or pass through, a supplier. Yet supplier oversight is often limited to contract renewal and monthly service reviews that look at SLAs rather than resilience. The Bill exposes three common gaps:

• No clear view of which suppliers are critical. Contract value is a poor proxy. A low-cost managed service can be the single point of failure for a core process.
• Incident obligations are not mirrored in contracts. If you must report within 24 hours, your suppliers need to tell you much sooner.
• Fourth-party risk is invisible. Your critical supplier's own providers — hosting, security tooling, offshore support — are rarely mapped.

What to do now

Organisations do not need to wait for final guidance to make progress. Four steps put you in a defensible position:

1. Tier your suppliers by impact

Map suppliers to the business services they support and tier them by the impact of their failure, not by spend. Identify the managed service providers and any supplier likely to be designated critical.

2. Align contracts with reporting duties

Review critical supplier contracts for incident notification times, cooperation duties, audit rights and exit provisions. Build changes into renewal plans rather than reopening every contract at once.

3. Rehearse a supplier-originated incident

Run a scenario in which a critical supplier is compromised. Test who is told, how fast, who decides and how the 24-hour notification would actually be made. Most exercises reveal that the decision path is unclear.

4. Connect service management to resilience

Major incident, problem and change management already hold much of the evidence regulators will ask for. Make sure supplier-related incidents are classified consistently and that lessons learned reach the supplier governance forum.

The opportunity inside the obligation

Done well, this work does more than satisfy a regulator. A clear view of critical suppliers improves renewal decisions, exposes concentration risk and strengthens negotiating positions. Faster incident discipline reduces the cost of disruption. The organisations that treat the Bill as a prompt to tighten supplier and service governance will come out more resilient and better able to prove it.

The test for leadership is straightforward: if your most critical supplier failed tomorrow, could you show within 24 hours what happened, what it affected and what you did about it? If the honest answer is "not yet", the time to start is now.