Cyber Security and Resilience Bill: what should schools ask their IT suppliers?
News about a proposed cyber-security law can sound as though every school must act immediately. First check the current official position. Then ask useful questions about the IT services the school already buys.
For Schools, Multi-Academy Trusts, IT providers, Businesses · asitplan
Separate a proposal from a current rule
The Cyber Security and Resilience Bill proposes changes to the rules for some services that organisations rely on, including IT support providers. Check its progress on the official government and Parliament pages before treating a proposal as a new legal duty.
A proposal can change as it goes through Parliament. Avoid treating a headline or supplier's summary as proof that a particular duty already applies to the school.
The school should get appropriate advice about its own obligations where needed.
Understand who provides your IT
An external IT support company may call itself a managed service provider, or MSP. It can look after services such as computers, accounts or parts of the network, depending on its agreement.
List the services the school buys and the company responsible for each. Ask the supplier whether the proposal may affect its service and what it would mean for the school.
A clear answer should distinguish current arrangements from possible future changes.
Ask practical questions now
Who should staff contact if a service becomes unavailable or there is a suspected security problem? How will the supplier tell the school what has happened?
Ask which systems the agreement covers, who coordinates with other suppliers and what help is included. Check what information the school can recover and whether that process has been tried.
These questions can improve the existing arrangement while the legislative position is checked.
Keep the school's response proportionate
Discuss any proposed contract change with the person authorised to approve it. Ask for a written explanation of its reason, cost and effect on school work.
Keep safeguarding and data-protection reporting under the school's established procedures. The relevant school contacts should advise on those responsibilities.
A useful response to the news is an informed conversation and an up-to-date service record. Staff should not have to interpret a proposed law on their own to know whom to call when help is needed.
Sources and further reading
- DSIT Cyber Security and Resilience Bill factsheet: relevant MSPs
Relevant managed service providers; scope and implementation
Source checked 2026-10-10
- ICO personal data breach reporting guidance
Assess risk to people; report when required, update later
Source checked 2026-10-10
- NCSC choosing a managed service provider
Contract scope, service levels, backups, logs, access, exits and end-of-life systems
Source checked 2026-10-07