The New UK Cyber Law

Most small and medium businesses are outside their scope. Their customers and suppliers may not be.

Parliament is close to passing the biggest change to UK cyber security law since 2018. The Cyber Security and Resilience Bill completed its stages in the House of Lords on 2 November and has returned to MPs, who must agree to the changes made by peers. Royal Assent is to follow.

If you run a small or medium business, your first question is probably “Does this apply to me?” For most, it won’t apply directly. It will still affect you, mainly through the businesses you buy from and sell to.

What is the law for

The current rules, the NIS Regulations 2018, cover vital services such as energy, water, transport and health, as well as some digital services, such as cloud computing and online shopping.

The Bill updates them because attackers have changed their approach. Rather than going straight to a hospital or a utility, they go through the companies that supply them, such as IT providers and data centres. The government estimates the cost of cyberattacks to UK businesses at £14.7 billion a year.

Who is brought in

The Bill brings in:

• Managed service providers (MSPs). Businesses that look after other organisations’ IT on an ongoing basis, such as helpdesk support, network management or security monitoring. Medium and large MSPs are in scope. Small and micro MSPs (fewer than 50 staff and turnover under €10 million or about £9 million) are exempt
• Data centres above a size threshold
• Designated critical suppliers. A regulator can name a specific supplier, of any size, if its failure would seriously disrupt an essential service. This is the part that can catch smaller firms

Organisations that are regulated will have to:

• Report significant incidents within 24 hours, followed by a fuller report within 72 hours
• Tell affected customers when an incident hits them
• Meet security standards set by their regulator

Fines for the most serious failures can reach £17 million or 4% of worldwide turnover, whichever is higher.

Why it matters if you’re not in scope

Even if you’re outside the rules, they can still reach you.

Your customers will ask more questions. If you supply anyone in an essential sector (NHS trusts, councils, utilities, transport) or larger regulated firms, expect longer supplier questionnaires and requests for evidence. A Cyber Essentials certificate and a written incident plan will answer most of them.

Your IT provider’s duties change. If your MSP is medium or large, it will be regulated and must notify you when an incident affects you. Check what your current contract says about this. If your MSP is small, it won’t be regulated. In that case, you’ll need to ask the questions yourself.

You could be designated. Small firms aren’t automatically exempt. If you’re a specialist supplier that an essential service relies on, a regulator can bring you in.

What hasn’t been decided yet

Much of the detail will come through secondary legislation after Royal Assent: thresholds, exact definitions, reporting formats and how long organisations get to comply. Peers also voted for a wider review of the whole regime within 12 months, which the Government may try to overturn.

Until that is published, there is no final checklist, whatever some suppliers may claim.

What to do now

You can make a start without a big project:

1. List the customers you supply in essential or regulated sectors. That tells you where the pressure is most likely to come from
2. Check whether you hold Cyber Essentials. It’s the simplest way to answer most supplier questionnaires and covers the controls that prevent the most common attacks
3. Write down what happens in the first 24 hours of an incident. Who decides who you call, who tells customers? The government’s latest survey found that only 44% of small businesses have a continuity plan that covers cyber, down from 53% the year before
4. Ask your IT provider. Are you in scope? If you have an incident, what will you tell us and how quickly? What evidence can you provide us with to share with our own customers?
5. Decide who on your board owns this. Only 31% of UK businesses have formally given cybersecurity to someone at the board level. A non-technical director can do this well, as long as they follow it through

Speak to us

Clearsky IT is a managed service provider based in Wiltshire. We help businesses with these questions and conduct Cyber Essentials assessments.

If you’d like a straight answer on where this law leaves your business, or help getting the basics in place before your customers start asking, get in touch at hello@clearskyit.co.uk.

Sources

• GOV.UK: Cyber Security and Resilience Bill factsheets
• GOV.UK: Tough new laws to strengthen the UK’s defences against cyber attacks on NHS, transport and energy
• DSIT and Home Office: Cyber Security Breaches Survey 2025/2026