Cyber Security and Resilience Bill: What It Means for Your Supply Chain

Last updated 16 October 2026: rewritten with the current Parliamentary stage, a one-table summary of the Bill, the critical supplier designation test, a guide to the government factsheets and a 30-day supplier evidence review.

‍

Can we demonstrate we have taken appropriate steps to manage supplier risk? Auditors, regulators and boards all ask some version of it after a supplier incident, and it's often harder to answer than it should be.

Most supplier checks happen once, at onboarding, and the evidence starts ageing the day the contract is signed. In public sector audits and Cyber Assessment Framework (CAF) reviews, security teams describe supply chain as “always a big gap”.

The Cyber Security and Resilience Bill makes that question harder to avoid. It is still going through Parliament, but it extends UK cyber regulation to managed service providers, data centres and suppliers that regulators judge critical.

If you run essential services, your regulatory position changes. If you rely on suppliers in those categories, what you can expect from them changes too.

‍

What is the Cyber Security and Resilience Bill?

The Cyber Security and Resilience (Network and Information Systems) Bill is proposed UK legislation that updates the Network and Information Systems (NIS) Regulations 2018, the UK’s only cross-sector cyber security law. It widens which organisations are regulated, brings key suppliers under oversight, speeds up incident reporting and gives regulators stronger powers.

Network and information systems are the computers, networks, software and data an organisation depends on to keep a service running. In the government’s own example, an NHS hospital’s systems include patient records, diagnostic tools, staff scheduling software and connected medical devices.

The government groups the Bill’s reforms into three parts:

• Expanded scope. Data centres, managed service providers and large load controllers come into the regime, and regulators gain a power to designate critical suppliers to essential and digital services.
• More effective regulators. More kinds of harmful incident must be reported, with an initial notification within 24 hours and a fuller report within 72 hours. Regulators also get clearer powers to share information, recover their costs and enforce.
• Faster government response. Ministers can add sectors or update security requirements through secondary legislation. They can also direct regulators or regulated organisations to act when there is a threat to national security.

For most security teams, expanded scope matters most, because it reaches into the supply chain rather than stopping at the operator.

The Bill does not regulate the whole economy. The government is explicit that the regime covers services whose disruption would affect daily life. Much of the operational detail, including what designated suppliers must do, arrives in secondary legislation after Royal Assent.

The NIS Regulations sit alongside sector-specific laws, and the Bill keeps that arrangement. Telecoms providers remain under the Telecommunications (Security) Act 2021, and financial services firms under the Financial Services and Markets Act 2023.

Is this the same as the EU Cyber Resilience Act?

No. The EU Cyber Resilience Act (Regulation (EU) 2024/2847) is an EU product security law covering products with digital elements sold in the EU.

Its reporting obligations for manufacturers have applied since 11 September 2026, and most of its requirements apply from 11 December 2027.

The UK Bill regulates services and the organisations that run them, while the Cyber Resilience Act regulates products. A UK manufacturer selling into the EU may need to consider both.

‍

Cyber Security and Resilience Bill summary: the main measures at a glance

The Cyber Security and Resilience Bill makes eleven changes to UK cyber regulation. Four widen who is regulated, five change how regulators oversee and enforce, and two give government new powers to act. Three take effect within two months of Royal Assent. The other eight, including critical supplier designation and faster incident reporting, wait for secondary legislation.

Timing is where most readers misread the Bill. Royal Assent will not switch on the duties that matter most for supplier risk. Critical supplier designation, the new rules for managed service providers and data centres, faster incident reporting and the higher penalties all depend on secondary legislation. The government intends to consult on implementation in 2026, and has committed to communicating a business adjustment period before new or updated duties come into force.

Only three measures start within two months of Royal Assent, and none of them places a new duty on a supplier. That gives security teams time, but not a reason to wait.

The direction is set in the Bill. The evidence regulators and auditors will ask for, such as which suppliers support which services and how each has been assessed since the contract was signed, is easier to build before a deadline exists than after one.

Which rows matter most depends on where you sit:

• Already regulated under NIS. The incident reporting, enforcement and cost recovery rows change your own obligations, including the fees you will pay your regulator.
• Relying on suppliers in scope. The managed service provider, data centre and designation rows matter more. They change what those suppliers must do, and the new customer notification duty means you should hear sooner when a provider’s incident is likely to affect you.

The penalty figures are maximums. The government says its goal is a culture of compliance rather than widespread fines. When setting a penalty, regulators must weigh factors such as an organisation’s attempts at mitigation and its history of non-compliance, and penalties can be appealed to the First-tier Tribunal. How turnover is calculated will also be set in secondary legislation.

‍

Has the Cyber Security and Resilience Bill been passed? Status and timeline

No. As at 16 October 2026, the Cyber Security and Resilience Bill has completed all its House of Commons stages and is in the House of Lords. Lords Report stage is listed for 26 October 2026. The Bill becomes law at Royal Assent, but most of its duties then wait for secondary legislation.

The Bill has already been carried over from one session of Parliament to the next. A carry-over motion lets a bill continue into the next session rather than starting again, and the Commons agreed one on 6 January 2026. The Bill was reintroduced on 14 May 2026, completed its Commons Report stage and third reading on 16 June, and moved to the Lords the next day.

In the Lords, second reading took place on 14 July and committee stage began on 1 September. Report stage is listed for 26 October 2026, although Parliament notes that future dates can be provisional. Lords third reading follows. If the Lords have changed the text, both Houses then have to agree the final wording. Only after that does the Bill receive Royal Assent and become an Act, and no date has been set for it yet.

Amendments are still possible, so details can change before Royal Assent. The government has already updated several of its factsheets twice in 2026. The March update reflected the Commons committee debates, and the June update made clarifications for legal reasons.

What happens after Royal Assent?

Royal Assent starts a phased rollout rather than switching everything on at once. The government’s sequence has three stages:

• Day 1. The future-proofing powers and the post-implementation review.
• Month 2. The statement of strategic priorities and the information sharing rules.
• Later, through commencement regulations. These cover data centres, managed and digital service providers, large load controllers, critical suppliers, incident reporting, cost recovery and powers of direction. The enforcement changes also come in this way.

The government plans to consult on implementation in 2026 and publish its response, then lay the secondary legislation. Organisations get an adjustment period before new duties apply.

Managed service providers, digital service providers and data centres will have set timeframes to register with their regulator once their provisions are in force. Registration is a practical milestone to watch. Once it opens, you can reasonably ask your managed service, cloud and data centre providers to confirm whether they are in scope.

‍

Who is in scope of the Cyber Security and Resilience Bill?

The Cyber Security and Resilience Bill covers two groups:

• Already regulated under NIS, and staying in scope. Operators of essential services in energy, transport, health, drinking water and digital infrastructure, plus medium and large digital service providers.
• Joining the regime. Managed service providers, data centres, large load controllers and suppliers that regulators designate as critical.

Scope depends on the service an organisation provides, not its sector label. Drinking water supply is in scope, but wastewater sits only under economy-wide guidance. Most telecoms providers fall under the Telecommunications (Security) Act 2021 rather than NIS.

The new managed service provider category also has clear edges. The government’s own examples place an IT company that monitors and manages a customer’s network in scope. Three kinds of provider are out of scope: a software company selling a product with occasional remote patches, an installer that walks away after go-live, and a provider of operational technology with no ongoing IT management.

Where a provider is based does not decide whether it is in scope. Managed service providers are covered if they provide managed services in the UK, whether or not they are established here, and overseas providers must appoint a UK representative. For supplier assurance, that matters: a US-headquartered managed service provider supporting your UK estate is treated the same as a UK one.

Where does your organisation sit?

Most organisations reading this sit in one of three positions, and many sit in two:

• Directly regulated. NHS trusts, integrated care boards, and energy, transport, drinking water and digital infrastructure operators are already operators of essential services. For them, the Bill tightens existing duties.
• Outside direct scope, but relying on suppliers who are in it. This covers most local councils, central government departments, police forces, and financial services and insurance firms. For them, the Bill changes what their managed service, cloud and data centre providers must do. Financial services firms continue to work under the Financial Services and Markets Act 2023.
• A supplier who could be regulated or designated. The supplier sections below cover this position.

The positions overlap in practice. An NHS trust is regulated directly, but it also depends on managed service providers that may soon be regulated in their own right, and on specialist suppliers such as pathology providers that a regulator could designate. Its assurance work runs in both directions at once.

Public bodies also have two specific carve-outs. The government intends to exclude public sector organisations from designation as critical suppliers, subject to consultation. A public body providing IT services to other public bodies is also excluded from the managed service provider category, provided it is under public authority oversight and earns less than half its income commercially.

One rule cuts the other way. Data centres run by or for the Crown are within the new regime, apart from national security exemptions. A government body operating its own data centre at 10MW or more of rated IT load can therefore be in scope directly. Most public bodies won’t meet that threshold, but it’s worth checking before assuming you’re outside the Bill.

‍

What does the Bill change in the NIS Regulations 2018?

The Cyber Security and Resilience Bill changes the NIS Regulations 2018 in four ways:

• who is covered
• which incidents must be reported, and how fast
• who has to be told when something goes wrong
• how penalties are set

Existing operators feel the change mainly through reporting and enforcement. Managed service providers, data centres, large load controllers and designated suppliers feel it through scope.

The biggest practical change is when an incident becomes reportable. Under the current rules, an attacker who has broken in and is positioned to disrupt a service only becomes reportable once the disruption happens. The Bill moves that point earlier, to when an incident has, or is likely to have, a significant impact.

Incident reporting: 24 hours, then 72 hours

Operators of essential services, digital service providers, managed service providers and data centres report to their regulator, and the NCSC is told at the same time. The report comes in two stages:

• The initial notice, within 24 hours of becoming aware of an incident. It needs only the organisation’s name, the affected service and brief details.
• The full report, within 72 hours. It covers when the incident occurred, whether it is ongoing, its nature and its likely impact. It must also say whether it was caused by an incident at another regulated organisation.

In the government’s own example, an NHS trust hit by a major attack notifies the Department of Health and Social Care and the NCSC within 24 hours, then files the full report at 72 hours.

That question about other regulated organisations is where incident reporting meets supplier assurance. If a managed service provider or data centre causes your incident, your full report has to say so, which means you need to know quickly which supplier sits behind the affected service.

The Bill helps with that from the other direction. Data centres, managed service providers and digital service providers must tell customers likely to have been affected, with details of the incident and why they think you were affected. That duty applies only after the provider has filed its own full report, so it won’t arrive in the first hours of an incident. The contractual notification clauses you already rely on still matter.

The thresholds for what counts as “significant” will be set in secondary legislation after consultation. Until then, the rule applies to regulated organisations and significant incidents only. It is not a requirement to report every security event within 24 hours.

Who enforces it and what are the penalties?

Enforcement stays with the NIS regulators, of which there are now 12 across sectors. The Bill adds:

• the Information Commission for managed and digital service providers
• Ofcom for data centres
• DESNZ and Ofgem for large load controllers

Penalties move to two bands:

• The higher band. Breaches of incident notification and security duties, up to £17 million or 4% of worldwide turnover, whichever is higher.
• The standard band. Lesser breaches, such as a provider failing to register, up to £10 million or 2%.

Regulators issue a notice before any final penalty, and organisations can make representations and appeal to the First-tier Tribunal. Steps taken to fix a problem count in the organisation’s favour, and not every breach leads to a fine.

‍

What does the Bill mean for your suppliers and third parties?

The Cyber Security and Resilience Bill brings parts of the supply chain under direct regulation for the first time. Medium and large managed service providers and qualifying data centres become regulated, and regulators can designate other suppliers as critical. Organisations that depend on those suppliers still carry responsibility for managing the risk they bring.

What that means depends on where you sit:

• If you’re already regulated. Your existing duty to manage risks to the systems your service relies on still covers your suppliers. The Bill adds a second line of oversight, because some of those suppliers will now answer to a regulator of their own. That gives you more information about them. It doesn’t reduce what your own regulator expects you to show about how you manage them.
• If you rely on in-scope suppliers but aren’t regulated yourself. You gain better signals, mainly registration with a regulator and a duty to tell you about incidents likely to affect you. A supplier being regulated still isn’t the same as a supplier being assured for the way you use it.

Two incidents show why the Bill reaches into the supply chain, and they fail in different ways.

• MOVEit Transfer: one product, many organisations. From 27 May 2023, the CL0P ransomware group exploited a previously unknown vulnerability in MOVEit Transfer, a file transfer product used by organisations and their suppliers. It stole data from many of them through the same flaw.
• Synnovis: one specialist supplier, no knock-on chain needed. The 2024 ransomware attack on the pathology provider to London NHS trusts disrupted more than 11,000 appointments and operations and caused estimated losses of £32.7 million. The government also links the attack to the death of a patient.

Designated critical suppliers: could one of yours be designated?

Designation is a regulator’s formal decision that a supplier matters so much to regulated services that it should carry security duties of its own. A regulator can designate a supplier only if all four of these are true:

1. It supplies goods or services directly to an operator of essential services, a digital service provider or a managed service provider.
2. It relies on network and information systems to deliver that supply.
3. An incident affecting it could disrupt the services it supports.
4. That disruption would have a significant impact on the economy or on day-to-day life.

Regulators must also consider whether the service could realistically come from somewhere else. The government’s own data centre evidence shows the pattern. Just ten operators generate 80% of UK data centre revenue and control two-thirds of live capacity.

Designation follows a process. The regulator consults the supplier first, and the supplier can appeal to the First-tier Tribunal. Size alone doesn’t protect a supplier, since small and micro managed service providers can be designated. Public sector bodies are intended to be excluded. A designated supplier’s duties will be set in secondary legislation, and they won’t be stricter than those on the operators it supplies.

Designation is also a limited tool. Regulators decide it, not you, and it is meant for suppliers whose failure would be felt nationally. Your own list of critical suppliers should be longer than any regulator’s, because it reflects what would stop your services, not the country’s.

Worked example: tiering suppliers by service criticality, not contract value

In our conversations with public sector security teams, one problem comes up again and again: most digital procurement happens outside the security team’s remit. One security lead put it at “two thirds of digital procurement”, which leaves tiering to follow contract value by default.

Contract value is a poor proxy for risk. The example below shows the alternative. It is illustrative, not drawn from a named organisation, and it uses the same logic regulators apply to designation: impact, dependency on systems, and whether the service could come from somewhere else.

Our supplier criticality matrix gives you a template to do the same.

Two rows in the example tend to surprise people. The high-value facilities contract drops to the lowest tier because nothing critical breaks if it fails. The small specialist provider moves up because nothing could replace it quickly. Proportionate depth also matters at the bottom of the list. Small suppliers sent a full questionnaire are often, in one security lead’s words, “overawed by the sheer number of questions”.

Why a one-off check at contract signature won’t hold up

The pattern we hear most often from security teams is a programme that is strong up to signature and then stops. In one buyer’s words: “it was really strong up until they signed the contract. And then we just walked away and forgot about it completely.”

I heard one CISO once refer to third-party risk as a paper shield. He knew he had to do it. He was regulated, so he did it for the regulation, but he knew it wasn't actually offering him any kind of protection beyond a bit of paper that he had in that supplier if something were to go wrong.

Haydn BrooksCEO and co-founder, Risk Ledger

The Bill makes that gap harder to carry. A full incident report has to say whether a supplier’s incident caused yours, within 72 hours. That depends on knowing today which suppliers sit behind which services, and how they’ve changed since onboarding.

In practice, that means keeping assurance current for the suppliers already onboarded. Review them by exception when something changes, not on a fixed annual cycle alone. As one buyer put it, assurance is “not just a sort of driving licence type scenario”.

Reusing an assessment another organisation has already carried out can save you and your supplier time, but it supports your judgement rather than replacing it. Your organisation still owns the risk. Buyers have also been clear that they want evidence, not “a better questionnaire”. Questionnaires still have a place. What causes trouble is collecting the same answers repeatedly and letting them go stale.

‍

What the Cyber Security and Resilience Bill factsheets cover

The government has published 14 factsheets on the Cyber Security and Resilience Bill: a summary, plus one for each main measure. They were last updated on 30 June 2026. They explain the policy intent in plain English, with worked examples. They are policy papers, though, so the Bill and later secondary legislation take precedence.

The 14 factsheets fall into three groups:

• Scope. Data centres, managed service providers, digital service providers, large load controllers and designating critical suppliers.
• How regulators work. Incident reporting, the statement of strategic priorities, information sharing, cost recovery and enforcement.
• Government powers. Future-proofing, the power to direct regulated organisations and the power to direct regulators.

The summary ties them together and sets out when each measure starts.

For supplier assurance, four factsheets carry most of the useful detail:

• Managed service providers: Real examples of providers that are in and out of scope, which you can test your own suppliers against.
• Designating critical suppliers: The four conditions and the Synnovis case.
• Incident reporting: What a 72-hour report must contain, including whether another organisation’s incident caused yours, and when providers must tell their customers.
• Data centres: The clearest public sector example in the set. In July 2022, two data centres serving an NHS trust failed during a heatwave. Most clinical IT went down at three hospitals, and the trust spent £1.4 million in unplanned technology costs responding.

The factsheets change as the Bill moves through Parliament. They were first published on 12 November 2025, amended on 6 March 2026 after the Commons committee debates, and amended again on 30 June 2026 for clarity and legal accuracy. Each one shows its own “Updated” date at the top, and the collection page offers email alerts when anything changes.

The factsheets don’t contain the detail most teams are waiting for. That includes the thresholds for a “significant” incident, how turnover is calculated for penalties, and what duties a designated supplier will carry. All three arrive through secondary legislation after consultation. For more detail now, Parliament’s Bill page also publishes the explanatory notes, the delegated powers memorandum and the impact assessments.

‍

Which NCSC guidance applies to the Cyber Security and Resilience Bill?

The main NCSC guidance for the Cyber Security and Resilience Bill is the Cyber Assessment Framework (CAF). It is the outcome-based framework that nearly all UK cyber regulators use to assess organisations running essential services. Version 4.0, published in August 2025, covers supply chain under principle A4.

The Bill and the CAF do different jobs:

• The Bill sets the duties: These are to manage risk, report incidents and co-operate with the regulator.
• The CAF describes what meeting those duties looks like: It sets out outcomes rather than prescribing controls.

The NCSC developed version 4.0 in consultation with the cyber regulators that use it, and it is established in the public sector through GovAssure. For most regulated organisations and central government bodies, the CAF is the framework their supplier evidence will be judged against.

Principle A4 contains two outcomes:

• A4.a, Supply chain. You understand and effectively manage the risks suppliers pose to the systems behind your essential functions.
• A4.b, Secure software development and support. You maximise the use of secure, supported software, whether built in-house or bought in.

The CAF states accountability as plainly as the Bill does. If you rely on third parties, such as outsourced or cloud services, you remain accountable for protecting the essential function.

The “achieved” level also reads like a description of the Bill’s supply chain expectations:

• a deep understanding of your supply chain, including subcontractors
• factors such as a supplier’s ownership and nationality feeding into procurement decisions
• critical suppliers able to show security proportionate to capable, well-resourced attackers
• proactive contract management
• incident management in which you and your suppliers support each other in resolving incidents

That last point maps directly onto the Bill’s 72-hour report, which asks whether another organisation’s incident caused yours.

The CAF is not a checklist. Its indicators describe outcomes, and “achieved” against A4.a asks for more than most programmes collect today. Visibility of subcontractors is where many fall short, because the “not achieved” column includes having little or no visibility of them. For most teams, partially achieved is the realistic first target, and that level already requires knowing the full extent of the supply chain behind your essential functions.

Several other NCSC resources are linked directly from principle A4:

• The supply chain security guidance
• How to assess and gain confidence in your supply chain cyber security
• The cloud security principle on supply chain, which our guide to the NCSC cloud security principles covers

Local councils can also use the Local Government Association’s guidance on embedding cyber resilience in local government supply chains.

Financial services firms sit outside the NIS sectors, so NIS regulators won’t assess them against the CAF. Their expectations for supplier risk come from their financial regulators, under the Financial Services and Markets Act 2023 framework mentioned earlier.

‍

How does the Cyber Security and Resilience Bill compare with NIS2 and DORA?

The Cyber Security and Resilience Bill updates the UK’s NIS rules. It shares NIS2’s cross-sector scope, supply chain focus and staged incident reporting. DORA is different, because it applies only to EU financial entities and their ICT providers. In the UK, the closest parallel to supplier designation is the financial services critical third parties regime.

Which regime matters to you depends on where you operate:

• UK essential service operators, public bodies and their suppliers: The Cyber Security and Resilience Bill.
• UK organisations operating in NIS2 sectors in the EU: NIS2, through each member state’s own law, assessed separately. Our guide to NIS2 covers it in detail.
• Financial services firms with EU operations: DORA.
• UK financial services firms: Their own regulators’ rules. Some of their largest providers are now overseen directly under the critical third parties regime, and the Bill reaches them mainly through the managed service, cloud and data centre providers they share with other sectors.

The four regimes have converged on the same two ideas:

• Regulators move closer to suppliers that many organisations depend on: The Bill does this through designated critical suppliers, DORA through oversight of critical ICT providers, and the UK regime through critical third parties.
• None of them moves accountability off the customer: The FCA says plainly that the critical third parties rules don’t change financial firms’ responsibility for managing their own third-party suppliers. That is the same position the CAF takes for essential services.

The regimes don’t line up neatly. One is a UK Bill, one an EU directive implemented differently in each member state, one an EU regulation that applies directly, and one a UK regime that applies only once HM Treasury designates a provider. Reporting clocks start at different points, and penalties work differently. Use the comparison to see which rules apply to you, then read each regime’s own text.

‍

CSRB compliance: how should security teams prepare?

Start preparing for the Cyber Security and Resilience Bill with the evidence you’d need if a supplier incident happened tomorrow:

• Which suppliers support your essential services
• How each was assessed
• What you’ve checked since the contract was signed

The Bill isn’t law yet, so this is preparation rather than compliance. Most of the work is what the CAF and audit already ask for.

There’s a reason not to wait for the secondary legislation. The duties that will need the most evidence, such as reporting supplier-caused incidents within 72 hours and showing how critical suppliers are managed, depend on records most teams don’t keep today. Building that evidence takes longer than any adjustment period is designed to cover.

The CAF supply chain principle already sets the expectation regulators work from: know the full extent of the supply chain behind your essential functions, including subcontractors. Work done now counts twice, once for CAF, GovAssure or audit this year, and again when the Bill’s duties start.

The first steps depend on where you sit:

• If you’re directly regulated. Rehearse the 24-hour and 72-hour reports, including one where a supplier caused the incident. Map your supplier evidence to CAF principle A4.
• If you rely on suppliers who are in scope. Ask your managed service, cloud and data centre providers whether they expect to fall within the Bill. Check your contracts give you incident notification and access to evidence. Tier those suppliers first.
• If you’re a supplier who may be in scope. Check the managed service provider definition and size test. Plan to register within three months of the duties starting.

A 30-day supplier evidence review

If you’re a team of one, start with the right-hand column. The rest can follow once the top tier is covered.

How to show progress to your Head of

Progress is easier to show with measures than with a narrative. Five measures work for most teams, and none needs a target to be useful at the start:

• The share of critical suppliers tiered by service criticality
• The share of top-tier suppliers with evidence less than 12 months old
• The number of top-tier suppliers reviewed since contract signature
• Open findings by tier, and how long they’ve been open
• Known subcontractor dependencies behind your top-tier suppliers

The last measure is usually the weakest, and it’s the one CAF principle A4 asks about directly.

Common mistakes to avoid

Take this to your Head of

1. What it is: The Cyber Security and Resilience (Network and Information Systems) Bill updates the NIS Regulations 2018 and widens who is covered. That includes managed service providers, data centres and suppliers that regulators designate as critical.
2. Where it stands: As at 16 October 2026 the Bill is in the House of Lords, with Report stage listed for 26 October. It isn’t law yet, and the detail follows in secondary legislation.
3. Why it touches us: If directly regulated: we’re already regulated under NIS, so faster incident reporting and higher penalties apply to us, and some of our suppliers may gain their own regulator. If not: we aren’t regulated directly, but some of the suppliers behind our essential services may be.
4. The exposure: If one of those suppliers fails, auditors, regulators and the board will ask whether we can demonstrate we took appropriate steps to manage supplier risk.
5. What we need to show, and the next step: Which suppliers matter most, how each was assessed and how we’ve kept watching them since contract, mapped to CAF principle A4. Start with a 30-day review of our top-tier suppliers and the Supply Chain Risk Exposure Assessment.

‍

How we support supplier assurance for the Bill at Risk Ledger

We built Risk Ledger for the work this page describes: knowing which suppliers matter, keeping evidence about them current, and seeing the dependencies behind them. We support that supplier assurance work. We don’t decide whether you are in scope, file regulator reports, or guarantee compliance.

Most of the problems in this guide come from the same place. Every organisation assesses its suppliers on its own, one questionnaire at a time, and the answers start ageing as soon as they arrive.

Our model works differently. Suppliers keep one security profile, with their evidence attached, and share it with each customer that connects to them. Those connections form a network, which shows something no single customer’s records can: which suppliers, and which of their suppliers, many organisations depend on at once. That is the concentration risk regulators now look for when they consider designating critical suppliers.

It means supplier evidence kept current, dependencies visible beyond your direct suppliers, and a shared response when an incident hits a supplier that many organisations use.

The model has a trade-off, and we’re open about it. A common assessment framework means slightly less freedom over the exact questions you ask. Haydn Brooks, our CEO, describes it to customers as “a five or 10% hit on the granularity of questions you can ask”. In return, you get a much broader data set across many more suppliers.

Reusing a supplier’s profile supports your judgement. It doesn’t replace it, and your organisation still owns the risk decision. The network view of dependencies is also a starting point. Check it against your own service and architecture records.

‍

What security teams ask next

• How Do We Decide Which Suppliers Are Critical?
• How Do We Manage Risk Beyond Our Direct Suppliers?
• Who Regulates NIS in the UK?
• What Does NIS2 Require, and Does It Affect UK Organisations?
• What Does DORA Mean for Supplier Risk in Financial Services?
• How Does the UK Critical Third Parties Regime Affect Our Third-Party Risk Programme?

‍

Cyber Security and Resilience Bill FAQs

‍

_Sources

^{Cyber Security and Resilience (Network and Information Systems) Bill, UK Parliament
Cyber Security and Resilience (Network and Information Systems) Bill: stages, UK Parliament
Cyber Security and Resilience Bill collection, GOV.UK
Cyber Security and Resilience (Network and Information Systems) Bill: factsheets, GOV.UK
Summary of the Bill, GOV.UK
Relevant managed service providers, GOV.UK
Data centres, GOV.UK
Large load controllers, GOV.UK
Designating critical suppliers, GOV.UK
Incident reporting, GOV.UK
Enforcement, GOV.UK
Futureproofing, GOV.UK
Second post-implementation review of the Network and Information Systems Regulations 2018, GOV.UK
The Network and Information Systems Regulations 2018, legislation.gov.uk
Telecommunications (Security) Act 2021, legislation.gov.uk
Financial Services and Markets Act 2023, legislation.gov.uk
Cyber Assessment Framework, National Cyber Security Centre
CAF Principle A4: Supply chain, National Cyber Security Centre
Cyber Assessment Framework v4.0 released in response to growing threat, National Cyber Security Centre
Supply chain security guidance, National Cyber Security Centre
How to assess and gain confidence in your supply chain cyber security, National Cyber Security Centre
Embedding cyber resilience in local government supply chains, Local Government Association
‍#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A), CISA
Directive (EU) 2022/2555 (NIS2), EUR-Lex
Digital Operational Resilience Act (DORA) legislative summary, European Parliament
PS24/16: Operational resilience: Critical third parties to the UK financial sector, Financial Conduct Authority
UK financial regulators to begin overseeing critical third parties announced by Treasury, Financial Conduct Authority}