What the Cyber Security and Resilience Bill could change when you use a managed security provider
Published: 9th November 2026
The UK Cyber Security and Resilience Bill proposes bringing relevant managed service providers into the UK’s NIS regime and changing incident reporting for organisations in scope. If you use a managed security provider, agree how quickly it will notify you, what evidence it will share, who can access your systems and who can act out of hours. Put those commitments in the contract and test them in an exercise. Continue to follow your existing reporting obligations while the proposals progress.
If your managed security provider spots suspicious activity at 2 am, who calls your team, what evidence can they give you, and who can authorise containment? Those are questions worth settling before an incident, particularly if you rely on the provider to help meet sector reporting obligations.
What the Bill proposes
The Cyber Security and Resilience (Network and Information Systems) Bill will extend the UK’s NIS regime to relevant managed service providers and update incident reporting for organisations in scope. The proposed reporting model includes an initial notification within 24 hours of awareness of a qualifying incident and a fuller report within 72 hours, with the NCSC informed alongside the regulator. The proposals also provide for relevant managed service providers to notify customers likely to be adversely affected in specified circumstances. The provider’s own regulatory reporting and your organisation’s reporting are separate responsibilities.
These are the proposals following the 3rd reading in the Bill in the House of Lords, before the Bill progresses towards Final stages. You can check the parliamentary record via the UK Parliament Bill tracker.
| Ask about | What to look for |
|---|---|
| 1. Notification. Who calls whom, when and by what channel? | Ask what triggers a customer alert, when the contractual clock starts and how the provider escalates overnight if nobody answers. Cover both attacks on your environment and compromises or outages at the provider or its suppliers. Agree a route that works if email or the customer portal is unavailable. Ask for an example of the first notification, including what is known, what is uncertain, action needed and when the next update is due. |
| 2. Evidence. What will we receive, and how quickly? | Ask for a redacted incident timeline and sample case export. Check that these distinguish detection, awareness, escalation and response times, identify affected services, record decisions and link back to relevant telemetry. Agree who preserves logs and forensic material, what can be exported, retention, and secure transfer. If your regulator needs evidence at short notice, agree who retrieves it and who can approve disclosure. |
| 3. Supplier access. Who can reach our systems and data? | Ask which people, service accounts and subcontractors can access your environment, from where, for what purpose and for how long. Ask how privileged access is approved, logged, reviewed and revoked. Check where telemetry is processed and stored, and how you would suspend provider access if its own credentials or tools were compromised. |
| 4. Response ownership. Who can act while we are offline? | Walk through a live scenario. Who can isolate a device, disable an account or block traffic? Which actions are pre-authorised and which require your approval? For critical operations, identify who assesses safety and service impact before containment, who can reverse the action and who owns restoration. |
| 5. Contractual responsibilities. Where are these commitments written down? | Ask to see the service schedule, escalation matrix and response authority in writing. Check scope and exclusions, customer dependencies, notification and update commitments, evidence access, subcontractor obligations, continuity arrangements and exit support. Assign who decides if a regulatory report is required, who submits it and who supplies the facts. Align the contract with your shortest applicable reporting window. |
Test the handoff before you sign
Ask the provider to run a short exercise with your incident lead. At 2 am, suspicious activity appears in your environment and the provider’s portal is unavailable. Walk through the first call, what the provider can contain, what evidence your team can get and who makes the reporting decision. Repeat the exercise for a compromise of the provider’s own privileged access. Capture any unanswered questions in the contract or onboarding plan, with a named owner and a date to resolve them.
Summary
Use your next service review or renewal to walk through a realistic incident with your provider. Could your team get a call and the evidence it needs if the portal went down overnight? Who could contain the incident, and who would decide whether your organisation needs to report it? Record the answers in your service schedule and escalation plan. Give each unresolved point an owner and a deadline.
Discuss your current arrangements with Red Helix. Bring your service schedule and incident escalation plan. We can walk through the handoffs with you and identify which responsibilities to settle before renewal or procurement.
