The Cyber Security and Resilience (Network and Information Systems) Bill is the biggest change to UK cyber law since the NIS Regulations in 2018. For managed service providers the headline is simple: medium and large MSPs would be regulated in their own right.
Where the Bill stands
It was introduced on 12 November 2025, completed its Commons stages, and had Lords committee stage conclude on 7 September 2026. It is not yet law. Much of the practical detail, including exactly which MSPs are covered, will follow in secondary legislation and regulator guidance.
What it would mean
- Scope. Medium and large MSPs that manage customers' systems, networks or data on an ongoing basis.
- Incident reporting. An initial notice to the regulator and the NCSC within 24 hours of becoming aware of a significant incident, and a fuller report within 72 hours. You may also need to warn affected customers.
- Regulator. The government has indicated the Information Commissioner would oversee MSPs, with powers to request information, inspect and enforce.
Smaller MSPs are not off the hook
Your regulated clients will have to show they manage supply chain risk. That pressure reaches you through contracts, security questionnaires and audits, whatever your size.
What to do now
- Write down your incident process, including who decides an incident is significant and how you would meet a 24-hour deadline.
- Keep an accurate record of which tools and accounts reach which clients.
- Enforce MFA, separate admin accounts and least privilege across RMM, PSA and remote access tools.
- Keep good logs. You cannot report what you cannot see.
- Hold Cyber Essentials Plus yourself. It answers many supply chain questions before they are asked.
- Make incident notification duties clear in client contracts.
This is general information, not legal advice, and the detail may change as the Bill progresses.