The Cyber Security and Resilience Bill: what UK SMEs need to know in 2026

The Cyber Security and Resilience Bill matters to UK SMEs mainly because it brings managed service providers into the regulated security perimeter for the first time. That changes the question every SME should ask about its IT and security supplier, whether or not the SME itself is directly in scope.

As of July 2026, the Bill has completed all its House of Commons stages, having passed third reading on 10 June 2026, and is now before the House of Lords, where it received its second reading on 14 July 2026. Royal assent is expected during 2026, with the detailed obligations phased in through secondary legislation over the period that follows, potentially into 2028. The direction is set, so the sensible time to prepare is now, not once the rules are in force.

This guide explains what the Bill does, what it means for an SME in practice, and what to do now. It is written for Managing Directors, Finance Directors and Operations Directors, not for IT specialists.

What the Bill is, in plain English

The Bill was announced in the King’s Speech of July 2024. It updates and expands the Network and Information Systems Regulations 2018 (NIS Regulations), which currently cover operators of essential services and a narrow set of digital service providers. The Bill broadens the scope, tightens incident reporting, and increases the powers of the National Cyber Security Centre and the Information Commissioner’s Office to enforce.

The headline themes are familiar: more organisations in scope, faster incident reporting, tougher supplier due diligence and larger fines for non-compliance. What is new for SMEs is the inclusion of managed service providers and managed security service providers in the regulated set. This ripples down to every SME that buys IT support.

Why managed service providers are now in scope

A successful attack on a single managed service provider can compromise hundreds of client firms in one move. The 2020 SolarWinds incident in the United States is the canonical case. Similar patterns have played out in the UK. The Bill recognises this concentration risk and treats MSPs accordingly.

For an SME, your MSP becomes part of your regulatory perimeter, not just your supplier base. The questions you ask before signing a managed services contract change. The evidence you keep on file changes. Whether your MSP can demonstrate its own cyber posture, in writing, becomes a board-level question.

If you are a Finance or Operations Director, “we have outsourced our IT” is no longer an answer to a cyber resilience question. You are accountable for the choice of partner, and you will need to evidence the basis for that choice.

The five practical changes to plan for

1. A wider definition of in-scope organisations. The Bill extends regulated status to a broader set of digital service providers, data centres and managed service providers. Some SMEs that were outside NIS will now be inside, particularly those providing technology services to other businesses.
2. Tighter incident reporting timescales. The Bill introduces a two-stage regime, with an initial notification expected within 24 hours of a significant incident and a fuller report within 72 hours. SMEs that rely on their MSP for detection will need to know how their MSP’s response times line up with these obligations.
3. Mandatory supplier due diligence. In-scope organisations will be required to assess and manage the cyber risk in their supply chain. If you supply larger organisations, your client may now ask harder questions about your own cyber posture and the posture of your MSP.
4. Stronger enforcement powers. The Information Commissioner’s Office and sector regulators are expected to have enhanced powers to investigate, require remediation, and impose financial penalties. The penalty ceilings are expected to rise materially.
5. Alignment with EU NIS2 outcomes. The Bill is the UK’s response to the same risks the EU has addressed through NIS2. UK SMEs that supply EU regulated firms will need to demonstrate alignment with NIS2 expectations, and the Bill is the closest UK equivalent.

Supplier due diligence: the new question for your MSP

The most important change for SMEs is the new weight on supplier due diligence. The questions you ask your MSP, and the answers you keep on file, will matter under both the Bill itself and the contractual cascade from clients who are in scope.

Questions a Finance or Operations Director should be asking the current or prospective MSP:

• Is the firm a Microsoft Direct Cloud Solution Provider? This removes intermediaries from the Microsoft licensing position, which matters for evidence of control. Lanmark is a Microsoft Direct CSP partner.
• Does the firm operate a 24x7x365 security operations centre? Lanmark Total includes 24x7x365 managed detection and response, identity threat detection and a SOC.
• Which security certifications does the firm hold, and can it show them? Lanmark holds Cyber Essentials.
• What are the firm’s own incident response times, and how do they support your reporting obligations under the Bill?
• Does the firm price predictably, so that security cover does not become a surprise cost at the worst moment?

The MSP that can answer these in writing, with evidence, is the partner the Bill effectively requires SMEs to choose.

Incident reporting: what changes for SMEs and their providers

Under current NIS, in-scope organisations report significant incidents to the relevant competent authority. The Bill is expected to shorten the initial reporting window and broaden the definition of a reportable incident.

This matters even when the SME itself is not directly in scope. If your MSP is in scope, their reporting obligations apply to incidents they detect on your estate. The clock on those reports starts running from the moment of detection, which means the speed at which your MSP can detect and triage an incident is now a regulatory question, not just a service one.

The shift from antivirus to managed detection and response (MDR) is the practical answer. MDR services watch the estate continuously, contain compromised endpoints within minutes, and provide the timestamped evidence the new reporting regime expects.

What to do now, before the Bill is in force

• Identify whether your firm is likely to be in scope directly. If unsure, ask your trade body or legal adviser.
• Map your supplier dependencies, particularly your MSP, line-of-business platforms and data processors. Document the cyber posture you understand each to have.
• Ask your MSP, in writing, what their detection and response times are, what accreditations they hold, and how they will support your incident reporting obligations.
• Confirm endpoint detection and response (EDR) and a 24x7 MDR and SOC service are in place, with documented response time commitments.
• Review your Microsoft 365 licensing and configuration. A Microsoft 365 licence review will surface the conditional access, identity and data protection gaps the Bill makes more important.
• If you are in a regulated sector, read our financial services IT strategy 2026 guide alongside this one. The two regimes overlap.
• Sign up to gov.uk and NCSC updates so you see the Bill’s progress first hand rather than through secondary commentary.

Where Lanmark fits

Lanmark is built for UK small and mid-sized businesses that need a strong cyber posture on a sensible budget. We are a Microsoft Direct CSP, hold Cyber Essentials, and include 24x7x365 managed detection and response in Lanmark Total, which is priced per user per month.

If you would like a structured starting point, contact us and we will look at your current MSP arrangement against the supplier due diligence questions above and give you a written view you can keep on file. See also our cyber security services.