If an outside company runs part of your IT, that company may soon be regulated. When did you last read what your contract says about it?
The Cyber Security and Resilience Bill is in its final stages in Parliament. The Bill puts its duties on providers, and it changes what you can reasonably ask of the people who hold the keys to your estate.
This article sets out where the Bill stands, what it does and what to do while you wait. It is a summary for business readers and is not legal advice. Position checked on 8 November 2026.
Where the Bill stands
The full title is the Cyber Security and Resilience (Network and Information Systems) Bill. It was introduced in November 2025 and amends the Network and Information Systems Regulations 2018. It has passed all stages in the House of Lords, which finished its third reading on 2 November 2026. At the time of writing the Commons is considering the Lords’ amendments. It is not yet an Act, and its final wording can still change. The Parliament bill page shows the current stage.
What the Bill does
The government’s published factsheets say the Bill will bring medium and large managed service providers that meet the definition of a “relevant managed service provider” within the Network and Information Systems Regulations. Their stated reason is that the security of these providers is currently unregulated in the UK, even though attackers have used them as a route into their customers.
Providers inside the definition would have to protect their own networks and systems and report significant incidents to the regulator, and any based overseas would need a UK representative. The government’s summary of the Bill and its page on relevant managed service providers give the detail.
What it does not do
The duties fall on the providers. A business that buys managed services does not become regulated because of the Bill. If you operate in a sector that the existing regulations already cover, such as energy, transport, health, water or digital infrastructure, you may have obligations in your own right, and you should take advice on that.
Why it still matters to you
A regulated provider should be a safer provider to depend on. The Bill does not tell you what your own estate costs you or who holds standing access to it. A provider that meets its legal duties can still leave you with a dependency you have never priced. We cover that pattern in The IT Vendor Trap.
Your own duties as a director are also moving. The government’s voluntary Cyber Governance Code of Practice, published by DSIT and the NCSC in April 2025, sets out what it expects of directors of medium and large organisations. The NCSC lists its five principles as risk management, strategy, people, incident planning, response and recovery, and assurance and oversight. It is voluntary today, and a buyer or an insurer can still ask whether you follow it. The question lands on the executive team.
Five questions to put to your provider this month
- What does our contract say about a significant incident on your side, and who tells us?
- Which of your staff hold permanent administrator rights to our estate? (Zero standing access explains why this matters.)
- Where is our data held, and what technically stops it moving? (UK data residency covers the difference between a clause and a control.)
- If we left tomorrow, could another team take over from documentation we hold? (The Continuity Codex shows what that looks like.)
- When did anyone last put a figure on what our estate costs us each year?
If you cannot answer all five from your own records, the gap is yours to close, whatever the Bill says.
What to do next
Put a number on it. The Technical Debt Burden Estimator takes five questions and returns an indicative annual cost by category. The Sovereignty Index® goes further: a fixed-fee diagnostic that scores your estate across five pillars and gives your executive team a written report with a ranked plan. You can read a sample report before you spend anything, and when you are ready, request an Index and you receive a written report with your own cost figure and a ranked plan.
We check the Bill’s progress regularly and will update this article when it receives Royal Assent.