On 12th November 2025, the UK government introduced the Cyber
Security and Re silience (Network and Infor mation Systems) Bill
(‘the Bill') aimed at strengthening cyber resilience of
organisations within key sectors in the UK. The Bill responds to a
recent in crease in cyber threats and intends to modernise and
expand the existing UK cybersecurity regime under the Net work and
Information Systems Regu lations 2018 (the ‘UK NIS
Regime').
The key change is that new categories of organisations,
particularly managed service providers (‘MSPs') and
those providing data centre services, will now be brought within
the scope of the UK NIS Regime. Further, the UK gov ernment will be
granted the power to impose the application of the UK NIS Regime on
entities it considers ‘critical suppliers'.
