Cyber Security and Resilience Bill: what it means for MSPs

Where the Bill stands

The Cyber Security and Resilience (Network and Information Systems) Bill is a government bill that would amend the NIS Regulations 2018. At the time of writing (1 November 2026) it was in its final House of Lords stage, with third reading listed for 2 November 2026, and it had not received Royal Assent. Any Lords amendments would still need to be considered by the Commons.

Even after Royal Assent, the government says further technical detail for managed service providers would come through secondary legislation. Check the Parliament bill page for the latest stage. For the Bill as a whole, including data centres, large load controllers and critical suppliers, see the Cyber Security and Resilience Bill guide on Cyber Essentials UK. This page covers the managed service provider angle only.

Who counts as a relevant managed service provider

The government's factsheet on relevant managed service providers (RMSPs) describes the proposed definition in plain terms:

• A managed service is one provided under a contract for the ongoing management of a customer's IT systems, whether through support and maintenance, monitoring, active administration or other activities, where the provider connects to or otherwise accesses the customer's network and information systems, on site or remotely.
• Examples given include IT outsourcing, such as remote support, helpdesks and management of applications like email and IT infrastructure, and managed security services, such as a security operations centre and security information and event management.
• A relevant managed service provider provides managed services in the UK, whether or not it is established in the UK, and is not a small or micro enterprise.
• Exclusions cover providing a data centre service or public electronic communications networks or services, providers of operational technology, and bodies under public authority oversight that earn less than half their income commercially.

So if you buy managed SOC services or SIEM as a service from a medium or large provider, that provider is exactly the kind of business the Bill targets.

The proposed duties

The initial notification only needs the provider's name, the service affected and brief details. The full report adds timing, whether the incident is ongoing, its nature, its likely impact and whether it was caused by an incident at another regulated organisation. For managed service providers, the factors for judging significance also include any impact on customers' own systems.

What it means if you buy managed services

The new duties would fall on the provider, not on you as its customer, but the Bill gives you a sharper set of questions to ask. Use them in renewals and new tenders:

1. Do you expect to be a relevant managed service provider, and are you preparing to register?
2. How will you tell us if an incident at your end is likely to affect us, and who will you contact?
3. Who monitors your own systems and remote access tools, and is that monitoring running around the clock?
4. How are administrative access to our systems and your remote management tools protected, including MFA?
5. Which security services do you deliver yourselves, and which come from a vendor's SOC?
6. What would you need from us to meet a 24-hour notification, and what will you share with us?

Our guide to how to choose an MSSP covers the wider selection questions, and MSSP vs MSP explains why the two kinds of provider carry different risks.

What it means if you are an MSP

Managed service providers are attractive targets because one compromise can reach many customers. The government's factsheet makes this point directly. For a provider, a 24-hour initial notice means knowing quickly that something is wrong on its own estate, not only on its customers'.

Practical steps that make sense now, whatever the final thresholds:

• Monitor your own estate: put endpoints, servers, identity and remote management tools under a 24/7 vendor MDR service, the same way you would for a customer
• Protect privileged access: strong MFA and identity threat detection on the accounts that reach customer systems; see managed ITDR
• Keep the evidence: central logs with enough retention to rebuild a timeline, through a SIEM as a service
• Plan the call: an incident response retainer and a customer notification plan written before you need them
• Fix the basics: Cyber Essentials for MSPs proves the baseline controls customers will ask about

Forever Systems does not run its own security operations centre. The 24/7 monitoring and response comes from the vendor services we resell, such as Sophos MDR, Check Point MDR or WatchGuard MDR; we recommend one, set it up, manage it and handle escalation with you. Forever Systems provides managed IT and security services too, so we can talk these questions through from both sides.

How we can help

Whether you are buying managed services or providing them, we can review how incidents would be detected and escalated today, recommend vendor MDR, ITDR, SIEM and retainer options that fit your tools, set them up and manage them, and help you build the notification facts from vendor case reports. We do not give legal advice on whether the Bill applies to you, and scope is confirmed at quote. Pricing depends on users, devices and data volumes, so ask us for a quote.

Contact us to prepare your monitoring and incident reporting for the Bill.