The Cyber Security and Resilience Bill (CS&R), currently making its way through Parliament, is a central part of the UK Government’s response to evolving cybersecurity threats. Given its importance, it is the subject of considerable media attention, but for many business leaders the key question is simple: what does it mean for us?

The legislation builds on existing regulations, but reflects a recognition that the cybersecurity risks facing critical public services and infrastructure have become increasingly sophisticated in recent years. The potential effects and implications of the CS&R Bill are therefore quite wide-ranging.

In this guide, we’ll look at what’s included in the new legislation, who is likely to be affected by it once it passes to law – as it is expected to do in the coming months – and what steps organisations should be considering now.

What is the Cyber Security and Resilience Bill?

The Cyber Security and Resilience, or CS&R Bill is designed to strengthen the UK’s existing cybersecurity framework, particularly the Network and Information Systems (NIS) regulations on which it builds. Specifically, it is intended to strengthen the cyber resilience of organisations providing essential services and critical infrastructure, including digital infrastructure.

In broad terms, the Bill is poised to widen the scope of existing regulation, bringing more digital service providers and potentially more suppliers into its purview. It will also enhance regulatory oversight and clarify expectations around incident reporting and risk management.

Instead of focusing purely on preventing attacks, the emphasis of the CS&R Bill is primarily on resilience; in other words, ensuring that organisations can withstand, respond to and recover from cyber incidents effectively. It implicitly acknowledges that no organisation can be rendered totally immune from attack, but also that organisations do have a responsibility to prepare for them.

Who’s likely to be affected?

The organisations most directly affected by the CS&R Bill are those providing essential services including energy, transport, healthcare and infrastructure. Managed service providers, cloud providers and some technology companies are likely to fall within the scope of the legislation.

The legislation will have a wider impact, however. Businesses serving as suppliers to entities covered by the Bill may also find themselves subject to higher cyber resilience standards and increased scrutiny, including demonstrating that they are not introducing security vulnerabilities into the supply chain.

This is where the ramifications of the Bill will be felt most widely. Even if they aren’t directly covered by the Bill themselves, businesses that act as suppliers and partners to entities that are may be asked to demonstrate stronger technical controls or provide evidence of compliance.

What will businesses be expected to do?

We’ll only know the full details of what’s to be included in the new law once it’s completed its passage through Parliament, but the direction of travel is clear enough. Specifically, organisations affected by the CS&R Bill will be required to prove ongoing management of cyber risk.

Stronger security controls

Businesses within scope of the legislation will need to show that appropriate technical and organisational controls are in place, including risk management processes and robust access controls. Vulnerability management will need to be more proactive, with backup processes also in place.

Mandatory incident reporting

The Bill proposes tighter requirements around reporting cyber incidents. Organisations will need to notify regulators within relevant time frames and provide detailed information about the nature and impact of any incidents.

Supply chain accountability

Organisations will be expected to assess and monitor the cyber risks arising from third-party suppliers and partners, and take steps to mitigate them. This may involve, for example, conducting supplier assessments or requiring recognised cyber certifications like Cyber Essentials.

Governance and oversight

Senior leadership teams will be expected to understand cybersecurity risks and their potential implications for business, as well as ensuring that appropriate protections are in place.

What does this mean for SMEs?

For SMEs acting as suppliers to entities covered by the new legislation, procurement processes are likely to become more rigorous. They may be asked to provide proof of documented policies, security controls and recognised certifications when bidding for contracts from these entities.

There is also a reputational dimension. As regulatory requirements increase, customers, partners and the wider public expect SMEs to prove that they take cybersecurity seriously. Failing to do so can cause lasting reputational damage – and trust, once lost, can be very difficult to regain.

Dangers of doing nothing

Ignoring the direction of travel which the CS&R Bill represents carries potentially very serious consequences. The legislation reflects a broader shift in how the UK approaches cyber risk, and cyber threats are now perceived as a major national resilience issue.

Businesses that cannot demonstrate adequate cyber controls risk losing out on contracts, and may also struggle to obtain cyber insurance or at least face higher premiums. Breaches, of course, can be devastating both financially and reputationally.

Organisations that treat cyber resilience as a strategic priority, however, will be much better positioned to thrive in an environment where scrutiny, accountability and vigilance are the watchwords with regard to cyber risk.