The Cyber Security and Resilience (Network and Information Systems) Bill received its second reading in the House of Lords on 14 July 2026, and for most UK businesses its most important change is indirect: medium and large managed service providers will be regulated for the first time, with a duty to notify significant incidents within 24 hours and to tell customers who are likely to have been affected. If your firm outsources IT support, monitoring or administration, your provider’s obligations are about to become part of your own risk picture.
The Bill updates the Network and Information Systems (NIS) Regulations 2018, the UK’s existing cyber security regime for essential services and certain digital services. It is not yet law, and much of the detail will come through secondary legislation and regulator guidance, but its shape is now settled enough to plan around.
Where is the Bill in Parliament?
According to Parliament’s bill record, the Bill was introduced in the Commons on 12 November 2025, had its Commons second reading on 6 January 2026, was carried over into the new session and reintroduced on 14 May 2026, and completed its Commons report stage and third reading on 16 June 2026. It had its first reading in the Lords on 17 June and its second reading on 14 July. Lords committee stage is next. Royal Assent has not yet been given, and the government’s own material indicates that many provisions will need regulations before they take effect.
Which IT providers come into scope?
The Bill introduces a new category of regulated entity: the relevant managed service provider. The government’s factsheet describes a managed service as one with four characteristics:
- it is provided under a contract for the ongoing management of a customer’s IT systems;
- it includes support, maintenance, monitoring or active administration;
- the provider connects to or accesses the customer’s network and information systems;
- that connection or access may be on-site or remote.
Small and micro managed service providers are exempt, although the Bill would allow smaller suppliers to be designated as critical suppliers in certain conditions. The regulator for managed service providers will be the Information Commissioner, which under separate legislation is becoming the Information Commission. In-scope providers will have to register, appoint a UK representative if based overseas, take appropriate and proportionate measures to manage security risks, and report significant incidents.
What will providers have to report?
More than they do today, and faster. The government’s incident reporting factsheet describes a light-touch initial notification within 24 hours and a full report within 72 hours, with the NCSC informed at the same time as the regulator. Reportable incidents will include those likely to have a significant impact, such as ransomware or pre-positioning by an attacker, even where no visible damage has yet occurred.
The change that matters most to customers is notification. After making a full report, a regulated managed service provider will have to identify which customers are likely to have been adversely affected and notify them, with details of the incident and why the provider believes they are affected. Today, whether you hear about an incident at your IT provider depends largely on your contract and your provider’s goodwill.
Why is the government focusing on IT providers?
Because a managed service provider holds privileged access to many organisations at once, and compromising one provider can compromise all of its customers. The NCSC’s 2025 Annual Review, published on 14 October 2025, recorded 204 nationally significant incidents in its reporting year, up from 89 the year before.
Customer-side scrutiny has not kept up. The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that only 15% of UK businesses reviewed the cyber risks posed by their immediate suppliers, and 6% looked at their wider supply chain. For most firms, the IT provider is the supplier with the most access and the least formal review.
What should you ask your IT provider now?
Supplier risk is the chance that a weakness at a supplier becomes an incident at your firm. The Bill gives you a reason to ask questions that should already be asked:
- Will you be in scope? A medium or large provider should already know whether it expects to be a relevant managed service provider, and what it is doing to prepare.
- How will you tell us about an incident? Ask for the trigger, the timescale and the named contact, and whether it will match the 24-hour and 72-hour rhythm the Bill describes.
- What access do you hold? List every account, tool and remote access path your provider uses, and confirm each is protected by multi-factor authentication and logged.
- Who else shares that tooling? Remote management platforms used across many customers are the high-value target. Ask how they are secured and monitored.
- What evidence can you show? Cyber Essentials Plus, ISO 27001 or an independent assessment, with dates and scope.
Our May article on the hidden cost of fragmented IT vendors explains why the number of providers with privileged access matters as much as the quality of any one of them.
What to do this quarter
- List every provider with remote or administrative access to your systems, and the type of access each holds.
- Ask each one whether it expects to be in scope of the Bill and how it will notify customers of incidents.
- Review contracts for incident notification clauses, and add a timescale where none exists.
- Confirm MFA and logging on every provider access path.
- Add provider incidents as a scenario in your own incident response plan.
- Record the review, so the board can see supplier risk has been examined rather than assumed.
How Rhentech helps
Our managed IT and cybersecurity service is built around the standards the Bill now sets for providers: clear access controls, monitored tooling and defined incident notification. For firms that keep their existing provider, a cybersecurity audit reviews third-party access and contract terms, and our incident response service plans for the scenario where the incident starts at a supplier.
If you rely on an outsourced IT provider and are not sure what it would tell you, or when, book a free initial consultation to discuss it.
Frequently asked questions
What is the Cyber Security and Resilience Bill?
It is the UK government’s bill to update the Network and Information Systems Regulations 2018. It was introduced on 12 November 2025, completed its Commons stages on 16 June 2026 and received its second reading in the House of Lords on 14 July 2026. It is not yet law.
Which managed service providers will the Bill regulate?
Relevant managed service providers: firms that provide ongoing management of a customer’s IT systems under contract, including support, maintenance, monitoring or active administration, and that connect to or access the customer’s systems on-site or remotely. Small and micro providers are exempt, though they could be designated as critical suppliers.
What will regulated providers have to report, and how quickly?
Under the government’s factsheets, an initial notification of a significant incident is due within 24 hours and a full report within 72 hours, with the NCSC informed at the same time as the regulator. Providers will also have to identify customers likely to have been affected and notify them.
Does the Bill apply to my firm if I only buy IT services?
Not directly, unless you are an operator of essential services or a provider in scope. The effect is indirect: your provider’s new duties change what you can expect from it, and your contracts should be updated so that its obligations to the regulator and to you are aligned.
Sources
- UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill: bill stages, accessed July 2026.
- DSIT, Relevant managed service providers factsheet, GOV.UK, updated 30 June 2026.
- DSIT, Incident reporting factsheet, GOV.UK.
- NCSC, UK experiencing four ‘nationally significant’ cyber attacks every week, 14 October 2025.
- DSIT and Home Office, Cyber Security Breaches Survey 2025/2026, 30 April 2026.
Reviewed 20 October 2026.