UK Cyber Security and Resilience Bill: MSPs and 1MW data centres in scope

Summary. The Cyber Security and Resilience (Network and Information Systems) Bill is not law yet. The Lords finished third reading on 2 November 2026, the Commons is listed to consider the Lords amendments on 24 November 2026, and on 13 November the Parliament record still showed a bill, not an Act. A Commons motion on 4 November gives it until the end of 29 April 2027 to pass. Once enacted, it amends the NIS Regulations 2018: data centres with a rated IT load of 1MW or more (10MW for enterprise data centres run only for their owner) become essential services regulated by Ofcom. Managed service providers that are not micro or small enterprises become relevant managed service providers (RMSPs), regulated by the Information Commission, including providers based outside the UK. Significant incidents need an initial notice within 24 hours and a full report within 72 hours, copied to the NCSC, and maximum fines rise to £17 million or 4% of worldwide turnover, whichever is higher. These duties start only when the government makes commencement regulations, and no dates are set. RMSPs will then have three months to register.

About this article. For MSP owners, data-centre operators and UK organisations that buy managed IT. On 13 November 2026 we checked the bill's stages against the UK Parliament Bills API, its provisions against the Lords text as amended on report (HL Bill 62), and the government's explanations against its factsheets updated on 3 November 2026. The Commons can still change the text, and most detail will come in regulations, so this is general information, not legal advice. Researched with AI assistance and reviewed by our editorial team.

Where the bill stands on 13 November 2026

The bill was introduced in the House of Commons on 12 November 2025 and carried over into the 2026-27 session.

The 4 November motion moved the date on which the bill would lapse from the end of 11 November 2026 to the end of 29 April 2027. Of 103 amendments agreed at Lords report, two were not the government's: a review of the whole NIS regime within 12 months of Royal Assent, covering frontier AI among other areas, and a register of foreign powers for the national-security directions. Third reading changes were technical. If MPs accept every Lords amendment, Royal Assent can follow; if they reject any, the bill returns to the Lords.

Royal Assent is not the start date

Royal Assent will not switch on the duties that matter most to MSPs and data centres. The government's summary factsheet sets out three phases:

• On Royal Assent: the future-proofing powers and the post-implementation review.

• Two months later: the statement of strategic priorities for regulators and the information-sharing provisions.

• By commencement regulations, on dates the Secretary of State chooses: powers of direction, data centres, the managed and digital service provider changes, large load controllers, critical suppliers, incident reporting and cost recovery.

The Lords text's commencement clause matches this split. The government says it intends to consult on implementation in 2026, publish a response, then lay regulations, and to announce an adjustment period before new duties apply. On 13 November 2026 the bill's GOV.UK collection page, last changed on 18 November 2025, listed no implementation consultation, and a GOV.UK search found none. That consultation is the next document to watch. The impact assessment puts the cost of the legislation at less than £150 million a year.

Who counts as a relevant managed service provider

In the Lords text, an RMSP provides a managed service in the UK, whether or not it is established here, and is not a micro or small enterprise as defined in the EU's Commission Recommendation 2003/361/EC. Bodies under public authority control are excluded unless more than half their income is commercial.

The size test is fixed in the bill, not left to regulations. Under that recommendation, a small enterprise has fewer than 50 staff and turnover or balance sheet total of €10 million or less; a micro enterprise has fewer than 10 staff and €2 million or less. A firm in a larger group may have to count the group's figures too.

A managed service has four parts:

• It is provided under a contract with a customer.

• It is the ongoing management of the customer's IT systems, such as support and maintenance, monitoring or active administration.

• The provider connects to, or otherwise gets access to, the customer's network and information systems, on site or remotely.

• It is not a data centre service or a public electronic communications network or service, which have their own rules.

Typical examples are IT outsourcing (remote support, helpdesks, application and infrastructure management) and managed security services such as SOC and SIEM. The factsheet gives these cases.

Three points catch people out:

• Offshore providers are covered. An MSP in India, the US or the EU that manages UK customers' systems must register and, if its principal office is outside the UK, nominate a UK representative.

• Small and micro MSPs can still be caught. Regulators can designate them as critical suppliers.

• Cloud management counts. Ongoing management of a customer's cloud service is in scope, so cloud-only MSPs should not assume they are outside the regime.

The Information Commission took over from the Information Commissioner's Office on 30 September 2026. It already regulates relevant digital service providers (online marketplaces, search engines and cloud computing services) under the 2018 regulations.

Which data centres are in scope

The bill makes data infrastructure a NIS sector and data centres an essential service, regulated by Ofcom. Data centres were designated as critical national infrastructure in 2024, but no minimum cyber or resilience requirements apply to them today.

The test is rated IT load, which the Lords text defines as the maximum electrical power available to run the IT equipment housed in the data centre.

• Data centres with a rated IT load of 1MW or more are in scope.

• Enterprise data centres, owned or managed by a business solely to provide IT for that business, are in scope at 10MW or more.

• Services run by the Security Service, the Secret Intelligence Service or GCHQ, or provided commercially to government for secret or top secret material, are exempt. Other Crown data centres are covered.

A data centre service means providing a physical structure with an area for housing, connecting and operating IT equipment, plus supporting power, environmental control, security and resilience infrastructure. A structure includes a building, part of a building or a group of structures, so a campus may be assessed as one data centre. The thresholds can be changed later by regulations.

Duties side by side

The table summarises the Lords text and the factsheets.

Detailed security requirements will come through regulations. Meanwhile the government cites Cyber Essentials, the Cyber Governance Code of Practice and version 4.0 of the NCSC Cyber Assessment Framework, which the NCSC lists as current, reviewed on 30 October 2026. They are sensible baselines, not yet the legal standard.

Incident reporting: 24 hours, 72 hours, then customers

Today, NIS incidents are reportable only if they have disrupted the service, organisations have up to 72 hours to notify their regulator, and only the regulator then tells the NCSC. Under the bill:

• Wider trigger. Harmful breaches such as ransomware and pre-positioning become reportable even when the service keeps running, if the impact is or is likely to be significant.

• Two stages. An initial notice before the end of 24 hours from first becoming aware, giving the name, the service affected and brief details. A full report before the end of 72 hours from the same moment, covering timing, nature, impact and whether another regulated entity's incident caused it, so far as known.

• NCSC in parallel. A copy goes to the NCSC at the same time as the regulator.

• Customers told. After the full report, data centres, RMSPs and digital service providers must, as soon as reasonably practicable, identify UK customers likely to be adversely affected, tell them what happened and why, and keep them updated.

For MSPs, significance turns on factors such as the extent and duration of disruption, users affected, compromise of user data, impact on customers' own systems and impact on the economy or society. For data centres, the tests cover significant impacts on the operator's own systems, or on the data centre service through an effect on the operator's or a customer's systems. Numerical thresholds will follow in regulations and guidance.

Worked example: an MSP ransomware timeline

A mid-sized UK MSP finds ransomware in its remote monitoring and management (RMM) platform at 09:00 on a Monday. Fifteen customers' servers are reachable from that platform. Assuming the incident duties have been commenced:

Both clocks start at awareness: Monday 09:00 plus 24 hours is Tuesday 09:00, and plus 72 hours is Thursday 09:00. Most MSPs struggle with the 24-hour step; weekend cover, a pre-approved template and a named decision-maker fix most of it.

Penalties, fees and a worked example in GBP

The bill replaces today's three bands (£1 million, £8.5 million and £17 million) with two:

• Higher band: up to £17 million or 4% of an undertaking's worldwide turnover, whichever is higher. This covers security duties and incident notification.

• Standard band: up to £10 million or 2% of worldwide turnover, whichever is higher. Failing to register as an RMSP or digital service provider falls here.

Regulations will define undertaking and turnover. Regulators must weigh factors such as mitigation and past non-compliance, and penalties can be appealed to the First-tier Tribunal.

Worked example (illustrative maximums, not expected fines):

Separately, a vendor risk power lets the government direct operators of essential services, including data centres, not to buy, to stop using or to remove specific goods, services or facilities on national-security grounds. RMSPs are not in scope for their managed services. Breaching a vendor direction carries up to £17 million; once regulations defining turnover are in force, an undertaking faces the greater of £17 million and 10% of turnover, which is £80 million for a data-centre group with £800 million turnover. A continuing breach can add up to £100,000 a day.

Regulators can also recover their full costs. Each must consult on and publish a charging scheme, may charge before or after costs arise, and cannot make a profit. No fee levels exist yet, so budget a fee line without guessing a number.

Other powers to note

• Critical suppliers. Regulators can designate a supplier to an operator, RMSP or digital service provider if an incident there could significantly disrupt the economy or society and the supply is hard to replace. The government cites the June 2024 Synnovis attack, which disrupted more than 11,000 NHS appointments and operations. NHS suppliers also face their own assurance route; see our DSPT 2026-27 guide for IT suppliers.

• Powers of direction. The Secretary of State can direct regulators or regulated entities to act against threats to national security.

• Agentic AI. A factsheet added on 3 November 2026 says the government will consult on four measures for incidents where operators lose control of AI agents: security requirements, notifying affected parties, preserving evidence such as agent action logs, and post-incident reviews. Our guide to AI agent identity governance covers the logging and permissions groundwork.

• Large load controllers. Organisations that control electrical load for smart appliances such as EV chargers come into scope at 300MW of potential control, regulated by DESNZ and Ofgem.

Firms that prepared for the EU's NIS2 Directive, which replaced the 2016 NIS Directive and widened scope and reporting duties, will recognise the approach, but the UK thresholds, registration routes and regulators are separate. Product makers selling into the EU also face the Cyber Resilience Act. A group-wide runbook should branch by jurisdiction.

What MSPs should prepare now

1. Run the scope test. Map each service against the four-part definition and check headcount, turnover and balance sheet, including group figures, against the EU micro and small enterprise ceilings.

1. Plan registration. Prepare the legal entity name, registered or principal office address, directors' names, contact details and, if your principal office is overseas, a UK representative. You will have three months after commencement.

1. Write the 24-hour runbook. Name the decision-maker, set weekend cover, pre-draft both notices and rehearse a ransomware scenario on your RMM platform.

1. Fix customer notification. Build a customer-to-asset map so you can tell who is likely to be affected within hours. Update master services agreements to cover notification, cooperation and evidence.

1. Harden privileged access. RMM tools and shared admin accounts give attackers one route into many customers. Enforce phishing-resistant MFA, just-in-time admin access and per-customer segmentation.

1. Map your controls. Use Cyber Essentials and the NCSC Cyber Assessment Framework as working baselines; our comparison of Cyber Essentials, ISO 27001 and SOC 2 helps choose between frameworks.

1. Check your own suppliers and agents. Expect questions about reliance on a single RMM, PSA or backup vendor, and keep records of any AI agent's actions and permissions on customer systems.

What data-centre operators should prepare now

1. Confirm rated IT load per site and whether each site is colocation, cloud or enterprise. Document the method, including how linked buildings are grouped.

1. Prepare the Ofcom notification pack: entity name, address, contacts, nominated representatives and service details, ready to file within three months of designation.

1. Review physical and environmental resilience. The government cites the July 2022 heatwave failure of two data centres serving an NHS trust, which took down most clinical IT systems at three hospitals. Cooling, power and fire systems sit inside the regime.

1. Agree incident interfaces with tenants. Customer systems can trigger your reporting duty, so set up two-way notification.

1. Review vendor exposure for building management, access control and power systems, given the vendor direction power.

1. Prepare for inspection. Ofcom can request information, inspect, interview staff and enter premises, guided by a statutory code of practice.

What UK buyers should ask their providers

Contract changes are the cheapest step: add notification timings, cooperation duties, evidence retention and a right to know the provider's regulatory status.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team can build the incident-reporting workflow, customer-to-asset map and privileged-access controls an MSP or data-centre operator needs before the duties commence. Talk to us at /contact-us/.

Last updated: 13 November 2026.

References

1. Cyber Security and Resilience (Network and Information Systems) Bill, bill 4035, current stage — UK Parliament Bills API

1. Cyber Security and Resilience (Network and Information Systems) Bill: what happens next, carry-over motion of 4 November 2026 — UK Parliament Bills API

1. HL Bill 62, Cyber Security and Resilience (Network and Information Systems) Bill as amended on report, 26 October 2026 — UK Parliament

1. Incident reporting factsheet, updated 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Enforcement factsheet, updated 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Bill 4035 stages and sittings — UK Parliament Bills API

1. Bill 4035, Lords report stage, amendments agreed — UK Parliament Bills API

1. HL Bill 62-I, marshalled list of amendments for third reading — UK Parliament

1. Summary of the Bill factsheet, updated 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Cyber Security and Resilience Bill collection — Department for Science, Innovation and Technology, GOV.UK

1. SME definition — European Commission

1. Relevant managed service providers factsheet, updated 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Information Commission succeeds the ICO as UK's data protection regulator, 30 September 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Data centres factsheet, updated 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Designating critical suppliers factsheet, updated 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Cyber Assessment Framework, version 4.0, reviewed 30 October 2026 — National Cyber Security Centre

1. Vendor risk management factsheet, 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Cost recovery factsheet, updated 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. Agentic AI resilience measures factsheet, 3 November 2026 — Department for Digital, Culture, Media and Sport, GOV.UK

1. NIS2 Directive: securing network and information systems — European Commission