UK To Update Cyber Security Regime With Cyber Security And Resilience Bill

The government announced it would be updating the UK's Cyber Security Regime shortly after it came into power in July 2024. On 12 November 2025, it presented the Cyber Security and Resilience (Network and Information Systems) Bill to Parliament.  

The Bill will largely expand and update the scope of the current 2018 NIS Regulations which implemented the EU NIS Directive, now replaced in the EU by the NIS2 Directive which was enacted after Brexit. This means the focus of the planned UK Bill is on operators of essential services (OESs), relevant digital service providers (RDSPs), relevant Managed Service Providers (RMSPs) and related supply chains. Much of what the Bill contains was trailed in the government's April 2025  policy statement so there are few surprises.