Cyber Security and Resilience Bill: What It Means for SMEs

Another cyber law is on its way, and you are probably wondering if it lands on your desk. You run a restaurant group, a 30-person practice or a factory. You are not a power station. So does the Cyber Security and Resilience Bill apply to you?

It moved closer on 26 October, when peers voted on it. Third Reading in the Lords was set for 2 November 2026.

For most SMEs the short answer is: probably not directly. But it will still reach you, through your IT provider and your bigger customers. This guide explains what the bill does, who it catches and what changed in the Lords. You also get a table by business type and a list of questions for your IT provider.

What is the Cyber Security and Resilience Bill?

It is a UK bill that updates the Network and Information Systems Regulations 2018. Those rules cover essential services such as energy, transport, health and water, plus some digital services. The bill does four main things:

• Widens the net. Data centres, medium and large managed service providers (MSPs) and large load controllers come into scope.
• Creates critical suppliers. Regulators can name the most important suppliers to essential and digital services, and regulate them too.
• Tightens incident reporting. A first notification within 24 hours, then a fuller report within 72 hours.
• Raises penalties. The higher band is up to £17 million or 4% of worldwide turnover, whichever is higher.

Regulators will also be able to recover the full cost of their work from the firms they oversee. Much of the fine detail will come later through secondary legislation, so some of this may still shift.

What just happened to the bill in the Lords?

Report stage took place on 26 October 2026. Three outcomes matter to UK businesses, according to VinciWorks’ summary of the debate:

• Regular scope reviews. Peers voted 202 to 155, against the government, for a review within 12 months of Royal Assent, then yearly. It could bring more sectors in. Advanced manufacturing is on the reported list.
• A narrower reporting trigger. Government amendments limit reportable incidents to those that have actually adversely affected systems, not those that merely could have.
• A second defeat. Peers voted 194 to 155 for a register of foreign powers that pose cyber threats to the UK.

None of this is final. MPs must now consider the Lords’ changes, and they can reject them.

What is the Cyber Security and Resilience Bill timeline?

The later dates are estimates, not commitments. Taylor Wessing notes full commencement may not arrive until 2028. You can track the live position on the UK Parliament bill page. Law firm Gowling WLG has said Royal Assent may come towards the end of this year, so plan on the bill passing but do not plan on an exact date.

Does the bill apply to small businesses?

Directly, for most, no. A restaurant group, an accountancy practice or an SME manufacturer is not an essential service. But there are three routes by which the bill can still reach you.

Route 1: through your IT provider

This is the one most firms will feel first. The government’s factsheet says a relevant MSP is one that provides managed services in the UK and is not a small or micro enterprise. Small usually means fewer than 50 staff and turnover up to €10 million.

Those MSPs must register with the Information Commission, the ICO’s successor, within three months of commencement. They must manage risk to their systems and report significant incidents. They must also tell customers who are likely to be affected.

That is good news for you, because you should hear sooner when something goes wrong. It may also cost you. If regulators recover their costs from MSPs, expect some of that to surface in pricing. Those early warnings also buy you time. If a customer of yours expects fast notice, you can only pass on what your provider tells you.

One gap is worth knowing about. The factsheet says providers of operational technology alone fall outside the managed services definition. So the machine vendor with remote access to your production line may not be covered. Ask them the same questions you ask your IT provider.

Route 2: through your customers

Regulated organisations will be expected to manage risk in their supply chains. That pressure flows downhill through contracts. Expect more security questionnaires, more clauses on incident notice and more requests for proof.

There is room for it to grow. The government’s Cyber Security Breaches Survey 2025/26 found only 15% of businesses review risks from immediate suppliers. Among medium businesses it is 30%.

Three questions usually come first. Do you hold Cyber Essentials? Do you use multi-factor authentication everywhere? How fast will you tell us about an incident? If you can answer those with evidence, you are ahead of most firms.

Route 3: critical supplier designation

This is the rarest route, but size alone does not rule it out. To be designated, a supplier must meet all of these conditions:

• It supplies a regulated essential service, digital service or MSP.
• It relies on network and information systems.
• An incident at the supplier could disrupt that service.
• The disruption would likely have a significant effect on the economy or society.

Regulators must also consider alternative sources and consult the supplier first, and a designated supplier can appeal. The government’s example is a cloud hosting firm serving a national transport operator, not a local parts maker.

What does it mean for your type of business?

None of the firms below is likely to be regulated directly. The difference is how the pressure arrives.

Picture a 40-person engineering firm on Deeside that makes parts for a contractor to a water company. It will not be regulated. But its next contract renewal might ask how fast it would report an incident. (This is an illustrative example, not a real client.)

Manufacturers have good reason to take that seriously. The Manufacturer points to the 2025 Jaguar Land Rover incident, which disrupted its wider supply chain. Our guide to IT support for manufacturing covers the basics to get right.

Or picture a 25-person accountancy practice in Chester whose largest client runs a bus company. The practice holds payroll and bank data. A one-page questionnaire arrives, and nobody knows who should answer it.

In hospitality, picture a growing group that opens a unit inside a regional airport. The landlord’s contract now asks for an incident contact and a 24-hour notice clause. Nobody at head office has ever needed one before.

What should you do now?

You do not need a compliance project. None of these duties is in force yet. These seven steps fit into normal work and are worth doing anyway:

1. Ask if your IT provider is in scope. Use the questions below.
2. List customers in regulated sectors. Energy, transport, health, water and digital services first.
3. Write a simple incident plan. Only 25% of businesses have a formal one. Cover who calls whom in the first 24 hours.
4. Test the plan once. A 30-minute walkthrough will find the gaps.
5. Get Cyber Essentials if you do not hold it. Just 5% of businesses do, so it still helps you stand out. Our Cyber Essentials password policy guide is a good place to start.
6. Read your supplier contracts. Check who must tell whom about an incident, and how fast.
7. Name one owner. Someone at director level should own this, even if the work sits elsewhere.

What should you ask your IT provider?

Send these seven questions. A good provider will answer them plainly, and that includes us.

• Do you expect to be a relevant MSP under the bill? If not, why not?
• Are you preparing to register with the Information Commission?
• How quickly would you tell us about an incident that could affect us?
• Who is our contact during an incident, including out of hours?
• How do you manage risk from your own suppliers?
• Do you hold Cyber Essentials, and what does it cover?
• Do you expect our contract or pricing to change?

A small provider outside the bill’s scope is not automatically a worse choice. It just means the law will not make those answers mandatory, so your contract has to.

From the Cirrus service desk: [CIRRUS INSIGHT: 2-3 sentences from Wayne or an engineer on what they actually see with this problem. Elis to fill in.]

Frequently asked questions

Has the Cyber Security and Resilience Bill been passed?

Not yet. At the time of writing it was finishing its Lords stages. MPs must still consider the Lords’ changes before Royal Assent, and most duties then need secondary legislation.

Is it the same as the EU Cyber Resilience Act?

No. The EU act covers products with digital elements sold in the EU. Its reporting duties began on 11 September 2026, and the main obligations follow on 11 December 2027. UK manufacturers selling connected products into the EU should check it separately.

Could my small business be fined under the bill?

Only if you are regulated under it. Most SMEs will not be. The bigger risk is commercial, such as failing a customer’s security check or losing a contract.

Does the bill make Cyber Essentials mandatory?

Nothing in the government’s factsheets makes it a legal requirement for SMEs. It may still become a commercial one, because customers can ask for it in contracts.

What cyber security law already applies in the UK?

UK GDPR and the Data Protection Act 2018 already require appropriate security for personal data. That applies to nearly every business, whatever happens to this bill.

Not sure where you stand?

Want a second pair of eyes before the questionnaires arrive? Book a free, no-obligation IT review call and we will help you spot the gaps and the quick wins. Just get in touch or call 0330 313 0966.

Cirrus is Cyber Essentials certified. You can read more about our cyber security services for small business and our outsourced IT support.

This is general information, not legal advice. The bill is still changing, so check the current text before you rely on it.

Related reading

• IT offboarding checklist: 14 steps when someone leaves
• Co-managed IT support: how it works, costs and what to expect