The Cyber Security and Resilience Bill is a UK bill introduced to Parliament on 12 November 2025. According to the government, it will reform and add to the Network and Information Systems Regulations 2018 to protect essential services such as electricity, safe water and the NHS from cyber attack. Check Parliament for its current stage.
What the government says
The gov.uk collection page describes the bill as a "fundamental step change in the UK's national security". It frames the reforms as a way to reduce business costs and disruption and support investment and economic stability.
The page does not list specific provisions. It links to factsheets, the bill text and an impact assessment. This post therefore stays at the level the page supports and does not summarize clauses.
Where it sits
The existing NIS Regulations 2018 apply to operators of essential services. The bill amends and extends that base rather than starting fresh. If you already work under NIS, you are the first audience.
The page says the bill had completed second reading and committee stage in the House of Commons as of its last update on 18 November 2025. That is out of date for a reader in late 2026, so confirm the current status on the Parliament site.
How to prepare without waiting
You do not need final text to do useful work.
- Find out which regulator would be yours.
- Map your essential services to the systems and suppliers behind them.
- Check the NCSC Cyber Assessment Framework, which organizations running essential services already use for self-assessment.
- Practice drafting an incident notice to a regulator.
For vendors
Suppliers to essential services should expect questions about incident notice, software inventory and patching. SBOM and dependency scanning in Safeguard can supply the inventory part, and compliance evidence automation helps keep proof in one place.
How to read a bill that is still moving
Bills change as they pass. Early summaries can be wrong by the time a bill becomes law, so treat any list of requirements, including those in law firm notes, as a prompt for questions rather than a plan. Useful habits: note the date of each source, check the Parliament page for amendments, and keep a short internal note that says "assumed, not final" next to each assumption.
If your organization already follows the NCSC Cyber Assessment Framework, you have a head start, because the bill extends a regime that framework already supports. If you do not, a self-assessment against it is a sensible first project and does not depend on the bill's timing.
Quick check
Is the bill law now?
The page we read shows an early stage from November 2025. Check Parliament for the current position.
Does it replace the NIS Regulations?
The government says it will reform and add to them.
Sources
Last reviewed: 19 October 2026.
