Cyber Security and Resilience Bill: Questions for IT Providers
A dated policy briefing with practical supplier-review questions, clearly separated from assumptions about future legal duties.
For Schools, Multi-Academy Trusts, IT providers, Businesses · asitplan Policy Team
Current position
The Cyber Security and Resilience (Network and Information Systems) Bill is still progressing through Parliament. Its published version on 7 September 2026 followed Grand Committee amendments in the Lords. Consult Parliament's bill page for the current text and passage.
Do not assume that every school, trust or supplier falls within its eventual scope. Applicability, obligations and commencement depend on the enacted legislation and relevant guidance.
Questions for your provider
- Which existing duties and contractual reporting commitments apply to our service?
- Who coordinates an incident, preserves evidence and escalates decisions?
- Which supplier dependencies could disrupt teaching or business operations?
- What evidence supports our recovery arrangements, and when was it last checked?
These are practical service-review questions, rather than a prediction of new legal duties.
Keep proposals separate
The Home Office's ransomware proposals are a separate policy programme. This briefing does not treat a ransomware payment ban or reporting proposal as a provision already enacted by this Bill.
Planning support
Record responsibilities, important dependencies and outstanding evidence in your review. Use our planning and evaluation checklist to structure that discussion. asitplan supports planning and evidence; it does not provide legal advice or certification.
Primary sources
Sources checked 10 October 2026.
Sources and further reading
- UK Parliament: Cyber Security and Resilience Bill
Current position
Source checked 2026-10-10
- Home Office ransomware proposals
Keep proposals separate
Source checked 2026-10-10