Cyber Security and Resilience Bill at Lords Report stage

As of 25 October 2026, the Cyber Security and Resilience Bill was scheduled for Report stage in the House of Lords on Monday 26 October 2026, carrying a freshly re-tabled power for ministers to direct organisations away from risky vendors. Here is where the Bill stood before that sitting, what it will ask of you, and what to watch at Report stage.

Where the Bill stood on 25 October 2026

The Cyber Security and Resilience (Network and Information Systems) Bill is the government’s overhaul of the NIS Regulations 2018. Its long title describes it, with characteristic economy, as a Bill to “Make provision, including provision amending the Network and Information Systems Regulations 2018, about the security and resilience of network and information systems used or relied on in connection with the carrying on of essential activities.”

It has had a long run. According to the Parliament bills service, it was introduced in the Commons on 12 November 2025, carried over into the new session and reintroduced on 14 May 2026, and passed its Commons Report stage and Third Reading on 16 June. In the Lords it had Second Reading on 14 July and three Committee days on 1, 3 and 7 September. Report stage was scheduled to begin on 26 October 2026. The sponsoring ministers are Liz Kendall in the Commons and Baroness Lloyd of Effra in the Lords.

What it will change for most organisations

The government’s factsheets set out the main shifts.

Managed service providers come into scope. Relevant managed service providers, or RMSPs, must have “appropriate and proportionate measures” in place and report significant incidents. Small and micro enterprises are excluded. The regulator will be the Information Commission, the body formerly known as the ICO, according to the RMSP factsheet.
Data centres become an essential service. The data centres factsheet says they will be designated as essential services, with data infrastructure recognised as a sector under the NIS Regulations, for those meeting the thresholds.
Faster, broader incident reporting. The incident reporting factsheet says: “A light touch, initial notification will be required within 24 hours and a full report within 72 hours, while the National Cyber Security Centre (NCSC) will be informed of incidents at the same time as regulators.” Reportable events include ransomware and pre-positioning attacks likely to have significant impacts in the UK, “even if they have not had an impact yet.”
Customers must be told. Data centres, RMSPs and digital service providers will have to identify customers likely to have been adversely affected by an incident and notify them.

The pre-positioning clause deserves a second reading. It means an intruder sitting quietly in your network can be reportable before anything breaks, if it is likely to have a significant impact, which is both sensible and, for many organisations, a significant change in what the SOC has to escalate.

The vendor direction power

The headline change at Report stage is not new so much as returned. A DCMS memorandum to the Delegated Powers and Regulatory Reform Committee, dated 19 October 2026, explains the history: “On 24 August 2026, the government laid 64 amendments relating to a new vendor risk management framework. The amendments were not moved at Committee Stage, to enable the government to work with peers on the concerns raised during the debate and re-tabling at Report Stage.” It adds: “The amendments were tabled for Report Stage on 19 October 2026.”

The framework gives the Secretary of State a power to direct an in-scope entity about its use of “a good, service or facility that presents a national security risk”. The memorandum lists the changes since Committee:

Only the Secretary of State may exercise the power; the Chancellor of the Duchy of Lancaster has been removed.
The made affirmative procedure, which would have allowed urgent regulations to take effect before Parliament approved them, has gone. Regulations bringing new entities into scope of the direction powers will all use the draft affirmative procedure.
A separate delegated power would allow a mandatory referral scheme for certain procurements, converting what starts as a voluntary referral regime.
The Secretary of State must publish a notice when a direction is issued and an annual report on directions.
There are 49 consequential changes elsewhere in the Bill.

When the amendments were debated in Grand Committee on 1 September, the minister, Baroness Lloyd of Effra, said the intention was “to limit the use of this power to operators of essential services in the first instance”. A follow-up letter to peers was deposited afterwards. Those words, “in the first instance”, are doing a fair amount of work, and peers may want them in the Bill rather than in Hansard.

What to watch at Report stage

The running list of amendments for Report runs to 165 amendments (as tabled up to 21 October). Three things are worth watching:

The scope of vendor directions. Whether peers press to put the “operators of essential services in the first instance” limit on the face of the Bill, or tighten the mandatory referral power.
Parliamentary control of secondary legislation. Much of the detail, including thresholds and some reporting rules, will be set by regulations. The DPRRC’s view of the new powers will matter.
Digital sovereignty. At Commons Report, new clauses on digital sovereignty and on a register of foreign powers were pushed to division and defeated. Similar arguments may reappear in the Lords.

cybersecurityandresiliencebill.com, a tracker run by the consultancy Precursor Security, reports that only 5 of 193 Committee amendments were agreed and expects Royal Assent between late 2026 and spring 2027. Treat that as an informed estimate rather than a timetable.

What to do now

If you are an MSP, work out whether you are an RMSP. Being neither small nor micro and remotely managing customers’ IT systems is the likely test. Start building the 24-hour notification path.
If you buy managed services, ask your providers how they will tell you about incidents, and add it to contracts at renewal.
If you run a data centre, watch the thresholds when they are published in secondary legislation.
Everyone in scope should decide now who in the SOC can declare a pre-positioning compromise reportable at 2am, because the regulator will not accept “we were waiting for Monday”.

More on what new law and guidance require of security teams is in Regulation & Standards.

Cyber Security and Resilience Bill: what to watch at Lords Report stage