UK Cyber Security and Resilience Bill: what it means if you buy from an MSP

Status checked 27 October 2026: the Bill is not yet law. It is at report stage in the House of Lords. This is not legal advice.

The Cyber Security and Resilience (Network and Information Systems) Bill would bring medium and large managed service providers (MSPs) under the UK's network and information systems rules for the first time. If you buy IT or security services from an MSP, the Bill would not regulate you as a buyer. Your provider might be regulated. That would change what your provider must do after an incident, what it must tell you, and what your contract should say.

Disclosure: Outpace Professional Services (OPS) sells managed detection and response services. This guide does not say whether any particular provider is in scope. That depends on the final law, the secondary legislation that follows it and each provider's facts.

Where the Bill stands

Scroll to read all columns.

After the Lords, the two Houses consider each other's amendments, and the Bill then needs Royal Assent. Many duties also depend on secondary legislation. The government factsheets we checked do not give a date when MSP duties would start. Future dates on the Parliament website can change. Source: UK Parliament, Bill stages, page last updated 22 October 2026.

Who would count as a relevant managed service provider

The government's relevant managed service providers factsheet (updated 30 June 2026) describes the proposed scope:

• Who: a person that provides managed services in the UK, whether or not it is established in the UK, and is not a small or micro enterprise.
• What: the ongoing management of IT systems under a contract, such as support and maintenance, monitoring or active administration, delivered by connecting to or accessing the customer's network and information systems.
• Examples: IT outsourcing, helpdesk support and managed security services such as security operations centre (SOC) and security information and event management (SIEM) services.
• Outside this measure: data centre services and public electronic communications services. Operational technology providers are not in scope of the MSP measure.
• Exempt: small and micro MSPs, and bodies under public authority oversight that earn less than half their income commercially. A small or micro MSP could still be designated as a critical supplier.

What in-scope providers would have to do

Based on the government factsheets:

• Register with the Information Commission, the regulator formerly known as the ICO.
• Appoint a UK representative if the provider is based outside the UK.
• Take appropriate and proportionate measures to manage risks to the systems used to provide managed services in the UK. Detailed requirements would come through secondary legislation.
• Report significant incidents to the regulator with an initial notification within 24 hours of becoming aware, and a full report within 72 hours, informing the National Cyber Security Centre (NCSC) at the same time.
• Notify affected customers. After the full notification, identify customers likely to have been adversely affected and tell them.

Incident detail comes from the government's incident reporting factsheet (updated 30 June 2026).

Data centres are a separate category

The Bill would also make medium and large data centres essential services, with Ofcom as the regulator. If your MSP hosts your systems in a third-party data centre, that data centre may have its own duties under a different regulator. Source: summary factsheet.

Proposed penalties for regulated entities

The government's enforcement factsheet (dated 30 June 2026) describes two maximum penalty bands:

• More serious breaches: up to £17 million or 4% of worldwide turnover, whichever is higher.
• Less serious breaches: up to £10 million or 2% of worldwide turnover, whichever is higher.

Turnover would be defined in secondary legislation. These penalties apply to regulated entities, not to their customers as buyers.

What changes for you as a customer

• You are not regulated as a buyer under the MSP measure. If your organisation is already regulated under the Network and Information Systems Regulations 2018, for example as an operator of an essential service, those duties continue separately.
• You may receive incident notices from your provider that you did not receive before. Decide now who receives them and what happens next.
• Expect contract and questionnaire changes as providers prepare for registration, security measures and reporting.
• Your own obligations stay with you. A provider's duties do not transfer your data protection, sector or contractual obligations.

Supplier-review checklist

Use these questions at your next supplier review or renewal. Expect provisional answers until the final law and secondary legislation are published.

Scope

• Does the provider expect to be a relevant managed service provider? Ask for its reasoning: its size, the services it delivers and whether it serves UK customers.
• Which of your services would count as managed services, and which sit outside the measure, such as data centre hosting or telecoms?
• If the provider is based outside the UK, who would be its UK representative?

Incident reporting

• How does the provider decide whether an incident is significant?
• Could it meet a 24-hour initial notification and a 72-hour full report today?
• How and when would it tell you if you were likely to be affected, and who on your side receives that notice?

Contract and notification terms

• Does the contract define an incident, and set the timing, content and channel for notifying you?
• Does it commit the provider to cooperate with your own investigation and preserve evidence?
• Do the same terms flow down to subcontractors that can access your systems?
• What are your rights if the provider faces regulatory enforcement or a direction that affects your service?

Evidence to request

• A description of current security measures for the services you buy.
• The provider's incident response plan and the date it was last tested.
• How its staff access your systems: privileged access, multi-factor authentication and logging.
• A list of subcontractors with access to your systems.
• Any certifications or independent assessments it holds, with their scope.

Renewal questions

• What would change in the service or the price if the provider becomes regulated?
• Will it commit to updating the contract once secondary legislation is published?
• What are the notice and exit terms if it cannot meet the new obligations?

For a related comparison of service types, read MDR vs MSSP.

Common questions

Is the Cyber Security and Resilience Bill law yet?

No. As of 27 October 2026, it is at report stage in the House of Lords, with Lords third reading provisionally listed for 2 November 2026. It still needs agreement between both Houses and Royal Assent.

Would the Bill regulate MSP customers?

Not as buyers under the MSP measure. Customers may receive incident notices and new contract terms from regulated providers. Organisations already regulated under the 2018 NIS Regulations keep those duties.

Which regulator would oversee MSPs?

The Information Commission, formerly the ICO, according to the government's MSP factsheet.

When would MSP duties start?

Only after Royal Assent and the relevant secondary legislation. The government factsheets we checked do not give a start date.

What are the maximum proposed penalties?

Up to £17 million or 4% of worldwide turnover for more serious breaches, and up to £10 million or 2% for less serious breaches, whichever is higher in each case.

Sources

Checked 27 October 2026. This is not legal advice.

• UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill and stages, last updated 22 October 2026.
• GOV.UK, Cyber Security and Resilience (Network and Information Systems) Bill factsheets, Department for Science, Innovation and Technology.
• GOV.UK, Relevant managed service providers factsheet, updated 30 June 2026.
• GOV.UK, Incident reporting factsheet, updated 30 June 2026.
• GOV.UK, Enforcement factsheet, 30 June 2026.
• GOV.UK, Summary factsheet.