People

Careers

Corporate

Commercial

Employment

News & Insights

Blog

News

Videos

Who we are

Environment & Sustainability

Diversity, Equity & Inclusion

WONDER Foundation

Get legal updates and practical guidance straight to your inbox.

You’ve successfully signed up to the Linnear Legal mailing list

Home

Resources

<p>Registered in England &amp; Wales at 73 Shelton Street, Covent Garden, London, WC2H 9JQ</p>
<p><a href="tel:+442081596000">Tel: +44 (0)20 8159 6000</a></p>
<p>Company Nr: 15894546</p>
<p>ICO Registration Nr:  ZB842887</p>
<p style="text-align: left;">VAT Registration Nr: 484 5226 73</p>
<p>Linnear Legal is an unregulated legal services provider, meaning the firm itself is not regulated by the Solicitors Regulation Authority (SRA). However, the solicitors employed by the firm are individually regulated by the SRA. Please see our Terms and Conditions for further information on our regulatory status, complaints procedure and insurance arrangements.</p>


Terms & Conditions

Cookie Policy

Privacy Policy

Services

Insights

About

We are driven by doing things differently, from every angle. 

Taking our Carbon Neutral Certified  status seriously.  

Putting equity and inclusion at the heart of everything we do.

Supporting sustainable employment and gender equality with WONDER. 

WONDER foundation

Contact us

We break down the UK’s upcoming Cyber Security and Resilience Bill and what it means for businesses. The Bill, part of the National Cyber Strategy, introduces new obligations for IT providers and supply chain partners supporting critical infrastructure. Learn when the bill is expected to pass and how preparing now can reduce legal risks and strengthen long-term resilience.

Cyber threats are rising. Find out how the UK plans to protect national infrastructure with new legislation.

<p>In today’s increasingly interconnected digital economy, the consequences of a cyberattack can be severe – not only for individual organisations but for the national infrastructure and economy as a whole. As threats from state-sponsored groups, cybercriminals and opportunist hackers escalate in frequency and sophistication, governments around the world are racing to enforce laws aimed at improving national cyber resilience and securing vital infrastructure.</p>
<p>In the UK, the upcoming <a href="https://www.gov.uk/government/collections/cyber-security-and-resilience-bill" target="_blank" rel="noopener">Cyber Security and Resilience Bill</a> (the Bill) is the latest step in this direction. The Bill is a centrepiece of the <a href="https://www.gov.uk/government/publications/national-cyber-strategy-2022/national-cyber-security-strategy-2022" target="_blank" rel="noopener">UK’s National Cyber Strategy</a> and ties into the ‘<a href="https://www.gov.uk/missions" target="_blank" rel="noopener">Plan for Change</a>’, a broader mission to kickstart UK growth, which has set a variety of milestones to be met by the end of this Parliament. It includes measures to boost the protection of supply chains and critical national services, including IT service providers and suppliers, with hospitals and energy suppliers among those prioritised.</p>
<h3>Why we need a Cyber Security and Resilience Bill</h3>
<p>A <a href="https://www.gov.uk/government/news/new-cyber-laws-to-safeguard-uk-economy-secure-long-term-growth" target="_blank" rel="noopener">press release issued by the government</a> at the beginning of April highlights the cost that cyber threats have weighed on the UK economy: almost £22 billion a year between 2015 and 2019.</p>
<p>UK public services feel the danger most acutely. Many NHS trusts still rely on IT systems that date back to the 1990s, a quirk that was <a href="https://www.wired.com/2017/05/still-use-windows-xp-prepare-worst/?utm_source=chatgpt.com" target="_blank" rel="noopener">exposed by the WannaCry ransomware attack on the NHS in 2017</a>. And only last year, <a href="https://www.ft.com/content/d2be7c65-bf44-4a7d-9791-6deafe66659f" target="_blank" rel="noopener">an attack on Synnovis</a>, a provider of pathology services to the NHS, cost an estimated £32.7 million and led to one of the NHS’s biggest patient data breaches.</p>
<p>An attack on energy services could be even more dangerous for the economy. According to the UK government, a hypothetical cyber attack focused on key energy services in the South East of England alone could wipe out over £49 billion, which is the total of UK’s annual defence budget – a figure comparable to a third of the GDP wiped out during the financial crisis of 2008.</p>
<h3>Key objectives of the Bill</h3>
<p>The Bill is still in draft form, but the policy statement released by the UK government proposes a range of new powers and responsibilities, including:</p>
<ul>
<li>Strengthening the UK’s cybersecurity reliance and addressing vulnerabilities in critical national infrastructure (CNI) sectors</li>
<li>Expanding the scope of regulation to managed service providers (MSPs), data centres and critical suppliers with digital and operational supply chains</li>
<li>Modernising and updating the existing NIS 1 Directive, including by aligning the framework with today’s cybersecurity landscape, incorporating aspects of the <a href="https://digital-strategy.ec.europa.eu/en/policies/nis2-directive" target="_blank" rel="noopener">EU NIS 2 Directive</a> and building flexibility and adaptability into the framework to account for technological developments</li>
<li>Enhancing the powers of regulators and providing them with incident reporting data and clear technical standards, such as the <a href="https://www.ncsc.gov.uk/collection/cyber-assessment-framework" target="_blank" rel="noopener">Cyber Assessment Framework</a> (CAF)</li>
<li>Supporting the ​<a href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener">National Cyber Security Centre</a> (NCSC) to manage national threats – the NCSC will receive bolstered authority and resources to address and mitigate cybersecurity threats at a national level</li>
</ul>
<h3>Scope and who will be affected by the Bill</h3>
<p>The Bill is expected to apply to:</p>
<ul>
<li>Operators of CNI services</li>
<li>Digital service providers, particularly those supplying public sector and CNI operations</li>
<li>Suppliers and subcontractors involved in key national supply chains, and</li>
<li>Organisations providing cybersecurity risk management services</li>
</ul>
<p>The government also plans to expand the definition of ‘relevant entities’, meaning that even organisations outside of traditional CNI sectors could be captured if they provide essential digital or IT services.</p>
<h3>Key provisions of the Bill at a glance</h3>
<p>Outlined below are some of the core elements proposed in the draft legislation.</p>
<h4>Broader scope</h4>
<p>A key change under the Bill is the expansion of who falls under regulation. More organisations and suppliers than previously covered by the NIS 1 Directive will be required to meet robust cybersecurity measures, including data centres, MSPs and critical suppliers.</p>
<p>This change will bring thousands of UK businesses into scope for the first time – many of whom will be unfamiliar with regulatory cybersecurity obligations. It’s important that businesses check whether they will be affected by the broader scope targeted by the Bill.</p>
<h4>Strengthened supply chain security</h4>
<p>By enabling the government to set stronger supply chain duties for operators of essential services (OES) and relevant digital service providers (RDSP), it is envisioned that the hole in previous legislation regarding having a targeted mechanism to address critical supply chain vulnerabilities will be plugged.</p>
<p>Additionally, regulators will have the ability to designate a supplier as a ‘designated critical supplier’ if the supplier’s goods or services being affected could cause significant disruption on an essential or digital service.</p>
<p>Organisations will be held responsible not only for their internal cybersecurity but also for that of their third-party service providers, especially if those services relate to critical operations. This may require due diligence of vendors’ cybersecurity practices, contractual obligations to enforce cybersecurity standards and continuous monitoring of supply chain risks.</p>
<h4>Two-stage incident reporting deadlines</h4>
<p>The Bill will introduce a new two-stage reporting structure if a significant incident occurs. Businesses and organisations who fall under the scope of the Bill will have to make an initial report within 24 hours, followed by a more detailed report within 72 hours of the incident.</p>
<p>All reports must be made to the NCSC as well as the relevant regulator, and in certain circumstances, customers will also need to be informed of the incident.</p>
<h4>Enhanced ICO powers</h4>
<p>The Bill aims to enhance the powers of the <a href="https://ico.org.uk/" target="_blank" rel="noopener">Information Commissioner’s Office</a> (ICO) to gather information and serve notices. It’s important to note, however, that another Bill – the <a href="https://bills.parliament.uk/bills/3825" target="_blank" rel="noopener">Data Use and Access Bill</a> – plans to modernise and replace the ICO with a new body called the Information Commission (IC), which will have a board structure and a chief executive.</p>
<h4>Flexible and future-proof regulatory framework</h4>
<p>By introducing a modular legal framework that gives ministers the power to designate new sectors, services and systems as ‘regulated’, it’s envisioned that the Bill will allow regulatory evolution as the cyber threat landscape changes over time.</p>
<p>As explained in the government’s <a href="https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement" target="_blank" rel="noopener">recent policy statement</a>, the Secretary of State would have powers without requiring an Act of Parliament to bring new sectors and sub-sectors in scope of the regulations.</p>
<h3>How does it relate to EU NIS 2?</h3>
<p>Although the UK is no longer bound by EU law, the EU NIS 2 Directive, which came into force in January 2023, has influenced the UK’s approach. Both frameworks share common goals, including enhancing national cyber resilience, improving breach reporting and extending regulatory oversight to more sectors.</p>
<p>With UK legislation developing old EU legislation, it’s probably reasonable to suggest we can expect much of the UK’s new cybersecurity legislation to echo provisions set out in the EU NIS 2. ‘Legislative proposals reflect the insights we have gathered from our international partners, including valuable lessons from the European Union on the implementation of its NIS2 regime,’ Peter Kyle <a href="https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement" target="_blank" rel="noopener">wrote in a ministerial foreword</a>.</p>
<p>‘They are also informed by consultations conducted by the previous Government in 2022 and 2023. However, it is vital that we also recognise the unique threats that the UK faces now and the threats that we cannot yet predict in the decades to come. At the same time, we must ensure that regulation works for businesses and investors, today and tomorrow.’</p>
<h3>Enforcement and penalties</h3>
<p>The government has made it clear that it is prepared to enforce compliance rigorously. Although final details of the penalty regime are yet to be published, businesses can expect:</p>
<ul>
<li>GDPR-style fines: potentially based on turnover and proportional to the harm caused by non-compliance</li>
<li>Public reprimands or compliance notices</li>
<li>Criminal liability for obstruction or wilful negligence, in severe cases</li>
</ul>
<p>Enforcement will follow a graduated approach, starting with education and guidance, followed by formal enforcement if required.</p>
<h3>What businesses should do to prepare for the Bill</h3>
<p>Even though the Bill is still progressing through Parliament, businesses should act now to prepare for its likely introduction. Steps to getting your business prepared for the Bill include:</p>
<ul>
<li>Identifying applicability of the Bill – does your organisation (or its clients) fall within the scope of the Bill?</li>
<li>Mapping critical systems and digital service dependencies</li>
<li>Conducting a cybersecurity gap analysis by reviewing existing policies, controls and incident response plans, and identifying deficiencies relative to expected legal obligations</li>
<li>Strengthening governance of cybersecurity policies – clear responsibility for cybersecurity at the board or senior management level should be established, as well as internal reporting and accountability structures</li>
<li>Reviewing supply chain risks</li>
<li>Aligning your business with best practice (i.e. standards such as ISO/IEC 27001 or Cyber Essentials Plus) and engaging in sectoral initiatives or NCSC partnerships to stay ahead of regulatory expectations</li>
</ul>
<h3>When can we expect the Bill to be passed into law?</h3>
<p>The UK government has now published a policy statement on the Bill, and the Bill is currently before Parliament. The expectation is that the Bill will be introduced to Parliament later this year. It is expected that the government plans to pass the Bill as quickly as practicable, with official announcements on the Bill having emphasised the urgent need for change following a string of high-profile cyber attacks on UK CNI sectors.</p>
<h3>Protecting your business from cyber attacks</h3>
<p>According to the UK government, the Bill is a response to a rising number of sophisticated cyber threats targeting UK organisations and companies. It’s not only a matter of security, but also of cost, with the government aiming to reduce the economic impact of cyber attacks, currently estimated to cost the UK billions each year.</p>
<p>In a <a href="https://www.gov.uk/government/news/new-cyber-laws-to-safeguard-uk-economy-secure-long-term-growth" target="_blank" rel="noopener">government press release</a>, Secretary of State for the Department for Science, Innovation and Technology (DSIT), Peter Kyle, said: ‘Attempts to disrupt our way of life and attack our digital economy are only gathering pace, and we will not stand by as these incidents hold our future prosperity hostage. The Cyber Security and Resilience Bill will help make the UK’s digital economy one of the most secure in the world – giving us the power to protect our services, our supply chains, and our citizens – the first and most important job of any government.’</p>
<p>By starting preparations now, businesses can not only reduce legal risk but also strengthen trust, resilience and long-term sustainability in an increasingly volatile digital landscape.</p>


The upcoming bill aims to defend critical services from escalating cyber threats, including cybercriminals and hackers. Learn what it covers and what it means for businesses.

What you need to know about the UK’s Cyber Security Bill 

Learn how the UK's Cyber Security Bill will impact businesses, compliance requirements and cybersecurity obligations.

What you need to know about the UK’s Cyber Security Bill  | Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/04/shutterstock_2078707768.jpg

Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/01/Linnear-Legal-logo.png

https://secure.gravatar.com/avatar/557c7f891380b6950d58942a774782ca?s=96&d=mm&r=g

What you need to know about the UK’s Cyber Security Bill

Related Insights