The Bill would regulate managed service providers for the first time. What their customers should ask now.
On Monday 26 October, the House of Lords reaches Report stage on the Cyber Security and Resilience (Network and Information Systems) Bill. It passed the Commons in June and has not yet received Royal Assent, so its details can still change. But its direction is clear, and one part of it reaches far more organisations than its headline sectors suggest.
For the first time, the Bill would bring managed service providers into the UK’s network and information systems regime. Most organisations will never be regulated under the Bill themselves. A large share of them will feel it through the company that runs their IT.
Who the Bill reaches
The government’s factsheet on what it calls relevant managed service providers describes a business that provides “ongoing management of information technology systems for the customer”, including “support and maintenance, monitoring, active administration”, and that connects to or otherwise obtains access to systems the customer relies on. Small and micro enterprises are exempt. The regulator for these providers would be the Information Commission, which took over from the Information Commissioner’s Office on 30 September 2026 and is still known as the ICO. That is the organisation that fined both of the suppliers below.
According to the factsheets, a provider in scope would have to register with the Information Commission, take “appropriate and proportionate measures” to manage its risks, and report significant incidents. The incident reporting factsheet sets out “a light touch, initial notification” within 24 hours and a full report within 72 hours. Once they have made a full notification, providers would also have to work out whether any of their customers are likely to have been adversely affected, and tell them. A government amendment tabled for Report would go a step further: having told those customers, a provider would have to send them “such updates about the incident and its impact” as it considers necessary.
The penalties are set in two bands. The higher band reaches £17 million or 4% of worldwide turnover, whichever is higher. Regulators would also be able to designate critical suppliers, the businesses whose failure could disrupt essential or digital services, and hold them to statutory cyber security requirements.
What customers check today
Set that against what buyers of IT services currently do. The government’s Cyber Security Breaches Survey 2025/2026 found that nearly half of businesses (48%) had an external cyber security provider. Yet only 15% said they reviewed the risks posed by their immediate suppliers, and 6% looked at their wider supply chain. Board-level responsibility for cyber security sat at 31% of businesses.
Those figures describe a market where a lot of security is bought and little of it is checked. The Bill puts its duties on the provider and leaves the customer’s side of that equation where it is. An organisation that outsources its IT still owns the risk to its own data, its own customers and its own operations.
Two cases that show why
The Information Commissioner’s Office has already fined suppliers whose failures landed on their customers.
In March 2025 it fined Advanced Computer Software Group £3.07 million. Advanced provides IT and software services to organisations including the NHS. The ICO found that hackers had accessed systems of its health and care subsidiary “via a customer account that did not have multi-factor authentication (MFA)”, and noted reports of disruption to critical services such as NHS 111. Personal information belonging to 79,404 people was taken.
In October 2025 it fined Capita £14 million, down from a provisional £45 million, after an attack that began in March 2023. One of the businesses involved, Capita Pension Solutions, processes personal information on behalf of over 600 organisations that provide pension schemes.
Both were data protection cases, brought before the Bill existed. They show the shape of the problem the Bill is aimed at: one provider, many customers, and a single control failure that reaches many of them.
The counterpoint: the exemption and the uncertainty
Two cautions apply. The first is the exemption. Small and micro managed service providers are outside the measure unless they are designated as critical suppliers, and many small businesses are likely to buy their IT from exactly those providers. For those customers, the Bill would do little to force a better answer. The questions below matter even more for those customers.
The second is that the Bill is not law. Report stage can amend it. One amendment tabled by Lord Clement-Jones, for example, would take advice, software support and help-desk services that involve no privileged access to the customer’s systems out of the definition of a managed service. The factsheets describe the government’s intentions, and the final wording will be the Act’s. I would not build a contract around a clause number until the Act is passed. But the questions a customer should ask turn on what a provider can reach and what happens when something goes wrong, whatever the final text says.
What to ask
The National Cyber Security Centre already publishes most of what a buyer needs. Its guidance on choosing a managed service provider, published in November 2025 for small and medium-sized organisations, includes a due diligence checklist. It asks whether the provider holds recognised certifications such as Cyber Essentials Plus or ISO 27001, what its policy is for applying updates, how backups are arranged and tested, whether you can put 2-step verification in place, whether logs are kept and for how long, and whether the contract specifies “how and when security incidents are notified”. Its older supplier assurance questions start with governance: “Knowing who the risk owners are is a key part of gaining confidence in your supplier.”
From those, the Bill and the two ICO cases, I would put ten questions to any IT supplier before the next contract renewal. Will you be in scope of the Bill? How and when will you tell us about an incident that affects us? Who owns cyber risk on your side, by name? Is multi-factor authentication enforced on every account that can reach our systems, including our own users’ accounts on your platforms? How quickly do you apply security updates on the systems you manage for us? How are our backups kept and tested? Which logs do you keep, for how long, and can we see them? What do your certifications cover, exactly? Which of your own suppliers can reach our systems or data? When did someone independent last test your security?
Who judges the answers
A board can leave the technical answers to others. What it needs to see is that there are answers, and that someone in the organisation is able to judge them. In my experience, that second part is the one most often missing.
Outsourcing tends to move the people who understood the systems out of the building. What is left is a contract manager who can tell whether a report arrived on time, but not whether the patching figures in it are good, whether the logs cover the right systems, or whether a backup test was a real restore. A supplier answering the ten questions above to someone who cannot weigh the answers is not much better than a supplier who was never asked.
One person who understands identity and access, update management, logging and backup well enough to ask a second question is usually enough, without a whole security team, to turn a supplier’s answers into assurance. The NCSC’s checklist and the Bill’s reporting duties give that person a structure. What they need on top is the confidence to say “show me”.
The Bill would raise the floor for providers that are big enough to be caught by it. Whether that helps any particular customer depends on whether the customer is asking.
This article is commentary on a Bill before Parliament and on published guidance, not legal advice. The Bill may change before it becomes law. Sources checked on 24 October 2026.
Sources
- UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill, stages (Lords Report stage from 26 October 2026): https://bills.parliament.uk/bills/4035/stages
- UK Parliament, Running list of all amendments on Report (HL Bill 49), tabled up to and including 21 October 2026: Lord Clement-Jones, Clause 9; Baroness Lloyd of Effra (government minister), Clause 16, updates to customers of relevant managed service providers: https://bills.parliament.uk/publications/68247/documents/8952
- DCMS and DSIT, Cyber Security and Resilience (Network and Information Systems) Bill factsheets, updated 30 June 2026: relevant managed service providers, incident reporting, enforcement, designating critical suppliers: https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets
- DCMS, Information Commission succeeds the ICO as UK’s data protection regulator, 30 September 2026: https://www.gov.uk/government/news/information-commission-succeeds-the-ico-as-uks-data-protection-regulator
- DCMS and DSIT, Cyber Security Breaches Survey 2025/2026, 30 April 2026: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- ICO, Software provider fined £3m following 2022 ransomware attack, 27 March 2025: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/
- ICO, Capita fined £14m for data breach affecting over 6m people, 15 October 2025: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/capita-fined-14m-for-data-breach-affecting-over-6m-people/
- NCSC, Choosing a managed service provider (MSP), 24 November 2025: https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp
- NCSC, Supplier assurance questions, 17 December 2020: https://www.ncsc.gov.uk/guidance/supplier-assurance-questions