The Cyber Security and Resilience Bill proposes bringing qualifying managed service providers into the UK’s cyber security regulatory framework. As a result, MSPs should understand who the proposals cover, what duties they introduce, and how to prepare.
It also raises a practical question: how clearly can your MSP explain the security risks it manages, the improvements it recommends, and the actions still outstanding?
In this guide, we explain the proposals and how regular client Security Reviews can support clearer communication and more consistent follow-up.
Status checked on 8 October 2026: the bill has not received Royal Assent. Parliament lists the current version as amended in Lords Grand Committee, with Lords Report stage scheduled for 26 October 2026. Proposals may change before becoming law. See the official parliamentary bill tracker.
What is the Cyber Security and Resilience Bill?
The Cyber Security and Resilience (Network and Information Systems) Bill would update the NIS Regulations 2018. These regulations already place security and incident reporting duties on certain essential and digital service providers.
The proposed reforms would extend the regime to additional organisations, including relevant managed service providers, qualifying data centres and designated critical suppliers. They would also strengthen incident reporting and regulatory powers.
The government’s summary of the bill explains the wider proposals.
Which MSPs could the Cyber Security and Resilience Bill cover?
The government’s MSP factsheet describes bringing medium and large providers within scope when they meet the definition of a relevant managed service provider, or RMSP. In particular, the definition concerns ongoing contracted management of customers’ IT systems involving access to those systems. It can also cover overseas providers that deliver qualifying services in the UK.
The proposals generally exclude small and micro enterprises from this particular measure. However, regulators could separately designate them as critical suppliers if they meet the relevant conditions.
Therefore, do not assume that the proposals cover every MSP, or decide solely from a headcount. Check the applicable service definition, enterprise-size rules and any designation against the final legislation.
For the proposed scope, read the government’s relevant managed service providers factsheet.
What would the Cyber Security and Resilience Bill require of MSPs?
Under the proposals, in-scope MSPs would register with the Information Commission, manage risks to the systems they rely on to provide managed services, and report significant incidents. In addition, overseas providers would need a UK representative. The government intends to introduce further technical requirements through secondary legislation.
Incident reporting
For qualifying incidents, providers would submit an initial notification within 24 hours of becoming aware, then a fuller report within 72 hours. They would notify the regulator and NCSC. They would also inform customers the incident likely affected adversely.
However, providers would not need to report every alert or attempted attack under these proposals. The incident criteria and significance thresholds matter. See the government’s incident reporting factsheet.
When would the Cyber Security and Resilience Bill take effect?
Royal Assent would not switch on every proposed requirement immediately. Instead, the government plans phased implementation, with secondary legislation providing further detail for MSPs. Therefore, monitor commencement dates and regulator guidance rather than assume a single compliance deadline.
Does the bill require regular client Security Reviews?
The proposals do not establish a blanket requirement for every MSP to send periodic Security Review reports to every client.
Instead, the central issue is the security and resilience of the systems an in-scope MSP relies on to provide managed services. These can include its own environment and customer systems supporting service delivery. Consequently, a client-facing report forms only one part of a much broader security process.
Nevertheless, our practical view is that consistent client reviews can help MSPs organise findings, explain recommendations and keep track of outstanding actions. Their value comes from the quality of the review and the follow-up it produces.
Preparing for the Cyber Security and Resilience Bill: five practical steps
1. Assess your potential regulatory scope
First, review how the Cyber Security and Resilience Bill could apply to your services, customer access and business structure with the appropriate adviser. Then record the basis for your assessment and revisit it as the legislation develops.
2. Review the systems used to deliver your services
Next, examine the tools and access your team depends on: PSA, RMM, identity systems, privileged accounts, remote access, backups and incident response arrangements. For each control, ask who owns it, how your team checks it and what evidence supports it.
Importantly, carry out this work alongside client reviews. Sending a polished report does not resolve weaknesses in your own service-delivery environment.
3. Make recommendations specific and actionable
As you prepare for the Cyber Security and Resilience Bill, keep client recommendations clear and actionable. Although these reports do not establish compliance, they can support better communication and follow-up. Each recommendation should explain:
- What the review found and the evidence supporting it.
- What business risk the finding creates.
- What improvement you recommend.
- Who needs to act and the agreed next step.
For example, if a particular backup service is not deployed, describe that finding accurately. Do not automatically conclude that the client has no recovery capability of any kind. Instead, check whether the client has other recovery arrangements.
4. Keep a clear record of communication and follow-up
Also, retain the findings, recommendations, report versions, recipients and relevant responses. Then give outstanding actions an owner and revisit them at the next review.
However, distinguish delivery, acknowledgement and approval. A client acknowledging a report access disclaimer does not automatically mean they approved every recommendation or accepted every risk described in the report.
5. Check incident escalation arrangements
The Cyber Security and Resilience Bill makes incident reporting an important preparation topic for potentially in-scope MSPs. Finally, make sure your team knows who assesses an incident, who makes reporting decisions and who communicates with affected customers. Test that process rather than relying on a document nobody has used.
Treat the proposed reporting windows as a preparation prompt while monitoring the final requirements and commencement dates.
How SecuVeo supports reviews as the Cyber Security and Resilience Bill progresses
As the Cyber Security and Resilience Bill progresses, MSPs have a useful opportunity to revisit security priorities with clients. SecuVeo helps make those discussions clear, consistent and actionable.
It brings together customizable templates, PSA Billing Evidence and Microsoft 365 Security Evidence to reduce manual preparation. Your team reviews the findings and recommendations, then sends a branded report explaining security risks and proposed improvements in plain English.
SecuVeo helps you:
- Show clients their existing protections and areas requiring attention.
- Explain recommended improvements and their business relevance.
- Track report delivery and disclaimer acknowledgements.
- Create PSA tickets and opportunities to move recommendations forward.
- Compare reviews over time and demonstrate the improvements delivered.
This gives your MSP a practical process for keeping clients informed, maintaining clear review records and turning security conversations into opportunities to strengthen protection and grow recurring revenue.
Start your free SecuVeo trial and build a repeatable client Security Review process.
Frequently asked questions
Is the Cyber Security and Resilience Bill law yet?
As of 8 October 2026, it remains a bill progressing through Parliament. Check the parliamentary tracker for subsequent developments.
Does the bill apply to all UK MSPs?
No. The Cyber Security and Resilience Bill proposes an MSP measure that targets qualifying providers and includes size-related exclusions. Separate critical-supplier designation could affect some smaller businesses. Therefore, assess your final scope against the legislation and guidance.
Does a Security Review report prove compliance?
No. A report can document findings and recommendations, but compliance depends on the applicable duties, effective measures and supporting evidence across the relevant services and systems.
Does a disclaimer acknowledgement remove an MSP’s responsibilities?
No. It records a particular acknowledgement. It does not replace effective security measures, contractual obligations or regulatory duties.
This article provides general information and practical commentary, not legal advice. Its regulatory summary reflects official sources checked on 8 October 2026.
