Cybersecurity & Infrastructure: New Bill introduced in November 2025
The government has proposed new laws to strengthen cyber defences for essential public services like healthcare, drinking water providers, transport and energy, bringing into scope medium and large critical service suppliers.
The Cyber Security and Resilience (Network and Information Systems) Bill (CSRB) introduced to Parliament on 12 November 2025 builds on the Cyber Governance Code of Practice (published in April 2025), moving guidance on managing digital risks into legally binding obligations.
Expanded scope
The new Bill applies not only to essential service operators but will include medium and large critical service suppliers. IT service providers, managed service providers, and cyber security firms supporting public and private sector organisations like the NHS will have specific requirements including reporting significant or potentially significant cyber incidents promptly to the government and their customers as well as having robust plans in place to deal with the consequences.
Incident reporting timing
Organisations must report significant or potentially significant cyber incidents to the government National Cyber Security Centre (NCSC), their customers, and their regulator - e.g. The Information Commission - within 24 hours, with a full report due within 72 hours to ensure rapid response and a stronger national picture of cyber threats.
Regulatory powers
Regulators can designate specific suppliers as “critical”, and enforcement powers are modernised to include turnover-based fines and daily penalties for ongoing breaches.
Technology Secretary oversight
The Secretary will have new powers to instruct regulators and organisations (e.g., NHS Trusts, water companies) to take specific, proportionate steps to prevent cyber attacks when there is a threat to UK national security.
Enforcement to be modernised
Tougher turnover-based penalties for serious breaches so “cutting corners is no longer cheaper than doing the right thing” will be introduced.
International alignment
The legislation brings UK cyber rules more closely in line with EU NIS2 standards, ensuring high standards for digital resilience and supply-chain security.
Posted on 12/02/2025 by Ortolan
