Where the Bill stands
The Cyber Security and Resilience (Network and Information Systems) Bill would amend the UK’s Network and Information Systems Regulations 2018. It completed its third reading in the House of Lords on 2 November 2026. The Commons agreed a carry-over motion on 4 November. Parliament’s record on 8 November showed consideration of Lords amendments awaiting a date. The Bill had yet to receive Royal Assent.
Which duties apply today?
Start with the existing NIS Regulations. If your organisation already falls within scope, follow the applicable security and incident-reporting requirements and your competent authority’s guidance. A supplier may also have contractual duties to assist its customer. Document which obligations come from regulation and which come from a contract.
What would the Bill change?
The amended Bill proposes wider coverage for specified data centre, managed service and load control activities. It also makes provision for critical suppliers to be designated. Some measures depend on further regulations or commencement decisions. Check the final legislation, definitions and dates before treating a proposal as an obligation.
Parliamentary position checked on 8 November 2026. Check the latest parliamentary stage before using these proposals in a board paper.
A useful scope question is: who would lose an essential service if our system stopped? Record the service provided, the affected customer or operator and the dependency. That is stronger evidence than assuming your entire sector is in scope.
How CAF helps assess resilience
The NCSC Cyber Assessment Framework assesses how well an organisation achieves outcomes for an essential function. Agree the relevant profile and the systems, people and suppliers that support that function. A useful assessment records both the evidence observed and its limitations.
- Manage risk. Who owns the function and its dependencies?
- Protect against attack. Which controls protect its continued operation?
- Detect security events. What signals would reveal that the function is under threat?
- Minimise incident impact. How would the organisation contain disruption and restore service?
Government assurance and supplier expectations
The Government Cyber Action Plan uses GovAssure and CAF profiles as part of assurance across government. A government assurance target does not automatically apply to every private supplier. Ask the customer or competent authority which function, profile and evidence it expects you to support.
Build an evidence record
Take one essential function, such as remote access for an operations team. Draw the dependency from the business service to its identity provider, access gateway and support supplier. Ask each owner what would happen if their part failed.
- Start with a dated observation. Record the function, owner, expected outcome, evidence and any coverage gap.
- Exercise a difficult decision. If the supplier reports ransomware, who can restrict access and who decides when to restore it? Record what the exercise demonstrated.
- Agree follow-up. Name the owner, target date and evidence that would show the gap has been addressed.
For example, the operations director could ask the identity owner to demonstrate emergency access to a test environment at the next resilience review. Leadership can then decide whether the observed recovery time meets the business requirement and assign any corrective action.
What to take to leadership
Bring three things: the duties that apply now, the proposed changes being tracked and the evidence for the most important service dependency. Give each unresolved decision an owner. Revisit the scope when the Bill progresses, the final measures commence or the regulator changes its guidance.
