The Cyber Security and Resilience Bill: What It Means for Your Suppliers

The UK's biggest overhaul of cyber security law in nearly a decade is now moving quickly through Parliament — and this time, the supply chain is squarely in the frame.

The Cyber Security and Resilience (Network and Information Systems) Bill cleared the House of Commons, entered the House of Lords on 25 June 2026, had its Lords second reading on 14 July, and is now at committee stage. Royal Assent is no longer a distant prospect; it is a question of months. For any organisation that relies on suppliers — which is to say, every organisation — the most important thing to understand about this Bill is simple: your third parties are no longer someone else's problem in the eyes of the law.

What the Bill actually does

At its core, the Bill modernises and expands the Network and Information Systems (NIS) Regulations 2018, the UK's inherited framework for protecting essential services. When those rules were written, the threat landscape looked very different. Since then, attackers have learned that the fastest way into a well-defended organisation is often through a weaker one connected to it — a supplier, a managed service provider, a piece of software buried three tiers down in the chain.

The Bill responds to that reality in several ways. It widens the range of sectors and organisations that fall under regulation. It hands the Secretary of State new powers to designate organisations, issue directions and update requirements as threats evolve. It tightens incident reporting duties so that significant incidents are flagged to regulators and, in many cases, to affected customers, within tight timeframes rather than at leisure. And — most significantly for anyone who manages vendor relationships — it extends regulatory oversight beyond the organisations that run essential services to the suppliers those services depend on.

The real headline: third parties are now in scope

Two provisions matter most for third-party risk.

The first is the treatment of managed service providers. MSPs — the firms that remotely manage IT systems, security tooling and infrastructure for other organisations — have long occupied a privileged position: deep access to their customers' environments, but light regulatory scrutiny. The Bill changes that, bringing relevant MSPs into scope with their own security and incident-reporting obligations. If you outsource the management of your systems, the organisation holding the keys will soon carry legal duties of its own.

The second, and more novel, is the concept of the designated "critical supplier". This is a mechanism that allows suppliers whose disruption could cause significant harm to essential or digital services to be brought directly under regulatory obligations — even if they would not otherwise have been regulated. It is a notably more interventionist approach than the EU's NIS2 Directive, which regulates essential entities but stops short of directly regulating their individual suppliers. In other words, the UK is prepared to reach further down the supply chain than its European counterpart.

For security and procurement leaders, the implication is unavoidable. Supplier risk is shifting from a matter of good practice and contractual comfort to a matter of legal obligation — both for your suppliers and, through your own due-diligence duties, for you.

Tighter reporting, less room to look away

The Bill also sharpens the incident-reporting regime. Regulated organisations will be expected to report significant incidents promptly — with an early notification followed by a fuller report — and to inform affected parties where appropriate. The practical effect is that incidents in your supply chain will surface faster and more visibly than they do today. An MSP compromise or a critical-supplier outage that might once have been quietly managed will increasingly become a reportable, documented event.

That is good for collective resilience. But it also raises the stakes for organisations that cannot see clearly into their own supplier estate. When the music stops, "we didn't know" will be an increasingly difficult position to defend — to a regulator, to a board, or to customers.

How it fits with DORA and NIS2

UK organisations do not operate in a regulatory vacuum. Those with EU operations are already grappling with NIS2 and, in financial services, the Digital Operational Resilience Act (DORA), both of which place heavy emphasis on third-party and ICT supply-chain risk. The direction of travel across all three regimes is the same: regulators no longer accept that responsibility for cyber risk ends at your own perimeter. The Cyber Security and Resilience Bill is the UK's contribution to a clear international consensus that supply-chain security is now a board-level, legally accountable concern.

For organisations subject to more than one of these frameworks, the practical answer is not three separate compliance projects but a single, coherent approach to understanding and managing supplier risk.

What security and procurement leaders should do now

The Bill is not yet law, and the detail will be refined as it passes through the Lords. But the direction is settled, and the organisations that prepare now will be the ones that treat the eventual deadline as a formality rather than a fire drill. Five priorities stand out.

Know your suppliers — all of them. Most organisations can name their top ten vendors but lose visibility beyond that, and almost none can map their fourth parties — the suppliers of their suppliers. Build a complete, current inventory of who you depend on and what access or data each one holds.

Identify your own critical suppliers. Work out which third parties, if disrupted or breached, would cause you significant harm. These are the relationships that will attract the most regulatory attention and deserve the most scrutiny now.

Move from point-in-time to continuous assurance. Annual questionnaires capture a supplier's posture on one day a year and are out of date almost immediately. Continuous, outside-in monitoring of your suppliers' security posture gives you the ongoing visibility that both good practice and the emerging regime demand.

Revisit your contracts and reporting expectations. Ensure supplier agreements set out clear security requirements and rapid incident-notification obligations, so that when an incident occurs you learn about it in time to act — and to meet your own reporting duties.

Treat your MSPs as an extension of your attack surface. The firms with the deepest access warrant the deepest assurance. Understand their security posture as rigorously as you would your own.

Visibility, not trust

The through-line of the Cyber Security and Resilience Bill is that trust is no longer a control. Assuming a supplier is secure because they are large, reputable, or have signed a questionnaire is precisely the assumption that attackers exploit. What the Bill asks of organisations — and what resilience genuinely requires — is visibility: a clear, current, evidence-based view of the security of every organisation you depend on.

That is a demanding standard, but it is an achievable one. The organisations that get ahead of this legislation will not be the ones with the thickest compliance binders. They will be the ones who can see their supply chain clearly, continuously, and act on what they see.

RiskXchange helps organisations gain continuous, outside-in visibility of their entire supply chain's security posture. To understand where your third-party risk sits today, get in touch.