The UK Cyber Security & Resilience Bill, first introduced to Parliament in November 2025, remains one of the most significant updates to the UK’s cyber regulatory framework in years. It updates the UK's Network and Information Systems (NIS) regime and is intended to strengthen the cyber resilience of critical services and digital infrastructure in response to evolving threats. It expands the number and type of organisations covered by cyber regulation, introduces enhanced incident-reporting requirements, gives Government and regulators new powers to set security requirements and respond to national security risks, and increases enforcement powers and penalties.
As members of the UK’s House of Lords debate the details of the proposed legislation this week, NCC Group’s Government Affairs Lead Louise Horton is on hand to offer additional insights as we look to consider the practical implementation of the legislation. Read on to find out more about what has changed, why the latest amendments matter, and what leaders should be watching for as the Bill moves towards implementation.
What is the current state of play for the Cyber Security & Resilience Bill?
"The Bill was introduced to Parliament almost a year ago now – November 2025 – and has since had its detail pored over and scrutinised by Parliamentarians and industry alike. As of now, the debate is taking place in the House of Lords, and the Government has most recently sought to introduce new powers through the Bill in late August.
Royal Assent – i.e. when a Bill finishes its passage through Parliament and becomes law – is likely in early 2027, with much of the implementation detail due to be introduced by secondary legislation and guidance thereafter. We expect the Government to consult on much of the detail for implementation either in late 2026 or 2027.
The secondary legislation will also need to go through Parliament before it is finalised and can be brought into force but will be subject to less scrutiny and potential for amendment than the main Bill provisions.
Broadly speaking, compliance is not usually required the moment a Bill becomes law. The Government has confirmed that there will be a business adjustment period before regulators step up expectations of compliance. Current expectations are that the new regulations will be fully in force by 2028-29.
While we await detailed implementation deadlines and requirements, organisations should actively begin readiness work to consider their existing cyber resilience posture and where new requirements might demand improvements. As previous examples have shown, waiting until a compliance deadline is upon an organisation rarely delivers the most effective and future-proof outcomes."
What have we learned from the debates in the House of Lords this week?
"As Lords from across the political spectrum quizzed the Cyber Minister on the details of the Bill and challenged parts of the legislation, we learned that supply chain risk remains a central concern for Government, particularly where dependencies in essential services could create national security risks that are challenging to manage through cyber assurance processes alone. The Government also signalled a commitment to include a requirement in the secondary legislation on Board-level governance and to set expectations for regulators to encourage professionalisation of the cyber workforce.
In Parliament, debate has expanded beyond the core cyber security features of the Bill including calls for additional sectors, such as manufacturing, retail and the public sector, to be brought into scope. The Bill debates have also become a forum for wider discussion about emerging technology risks, including frontier AI. Across both AI and cyber security, Lords have raised questions about the case for stronger regulation, balanced against concerns about the scope of executive power i.e. the Government’s ability to intervene in organisations’ business operations.
Recent changes to the machinery of government have also attracted Parliamentary attention, with concerns about accountability, clarity and effectiveness following the closure of the Department for Science, Innovation and Technology (DSIT) and the allocation of its functions across different other Government departments.
Despite wide ranging debate, the main tenets and direction of the cyber security measures in the Bill remain consistent."
What, if anything, do we expect to change as a result of the political debate?
"The debate sharpens our expectations around supply chain oversight, but the biggest practical impacts will be seen in how the regime - including new proposals on vendor risks - will be implemented, and where issues raised in Parliament might influence the scrutiny and safeguards built into the use of new powers."
What are the Government's new amendments on vendor-related directions?
"The Government has set out its intention to establish a new framework for managing vendor-related risks in essential services. This responds to national security concerns about escalating risks from goods or services supplied by another company into an essential service being used as a tool for harm such as destruction, espionage or other information collection. Risks could also arise from defective design or vulnerabilities.
The Government has stated it wants to work with organisations to address these risks through a voluntary scheme, such as through guidance and collaboration mechanisms. However, the amendments introduced ahead of the most recent Parliamentary stage in the Lords also provided for significant backstop powers that could require action on vendor risks by essential services through a mandatory scheme and ministerial directions. In practice, this could feasibly involve the Government preventing a supplier transaction going ahead or requiring removal of a product from a system."
Why has Government introduced these amendments?
"We already know all too well that cyber risk can often sit outside a single entity’s' perimeter, but these new powers go beyond familiar supplier assurance as a response.
As the Cyber Minister noted in the Lords debate, the Director of GCHQ referred to supply-chain vulnerabilities in the evolving geopolitical context in her annual lecture in May. The intention behind the proposed regime appears to be to identify and manage some of those risks before they become embedded in critical supply chains, where remediation could be more costly and disruptive.
In many respects this is an evolution in the existing approach by the UK Government to vendor related risks. The Telecommunications Security Act 2021 introduced vendor related powers for the telecoms sector, which we have only seen used once. The Government similarly acquired new powers to address national security concerns in its own supply chains through the Procurement Act 2023."
How do vendor directions differ from previous interventions?
"Vendor controls are more about the suppliers integrated within essential services, rather than effective cyber security strategies and overall organisational approaches. While there is read across to supply chain assurance, a vendor risks regime is more about preventing malicious activity taking place rather than detecting, responding and recovering from it."
How do these powers fit into wider discussions around digital sovereignty and trusted technology?
"These measures point to a growing focus on whether the suppliers embedded in essential services can be trusted, controlled and, if necessary, restricted. While the proposals are explicitly linked to nation-state activity, the Government’s approach appears to focus on specific risks and individual supplier-essential service relationships, rather than using nationality alone as the basis for restrictions or directions. The practical reality of how these themes of trust, control and dependency are implemented through a new framework remains to be seen."
What questions should organisations be asking about supply-chain risk? / How should CISOs think about vendor-direction risk today?
"Organisations should be asking which suppliers underpin their critical services, where specific points of failure or dependency might arise, and whether those dependencies are understood as business risks rather than only procurement or technology risks. This could include software, connected products, IoT devices and operational technology, depending on the service context. If a supplier needed to be restricted, isolated or removed, how quickly could the organisation respond, who would own the decision, and what would the operational impact be?"
What should organisations watch for over the next 12 months?
"The Government will likely return to the next stage of the Parliamentary process (Lords Report) this autumn with a revised proposal on the vendor risk framework, allowing more time for the House of Lords to understand the proposals. Later this year or early next year the Department for Digital, Culture, Media and Sport (DCMS) may seek input from industry on the implementation details for the Bill, which they will likely bring forward as secondary legislation in early 2027. This might include more details on the security requirements in the Bill, implementation timelines, reporting thresholds for incidents and any more detail on the vendor-risk framework."
What is your one key takeaway for security leaders?
"The new proposals reinforce that cyber leaders need to treat resilience as an ecosystem issue, not just a matter of internal controls. Government is increasingly interested in the dependencies behind essential services: who supplies them, how those suppliers are trusted and governed, and what happens if a critical dependency becomes a source of national security risk."
Louise Horton biography
Louise leads UK public affairs for global cyber security firm NCC Group, shaping the organisation’s engagement with government, regulators and key policy influencers. Louise joined NCC Group from the Cabinet Office, where she led on cyber resilience.
Contact
NCC Group Press Office
All media enquires relating to NCC Group plc.