A new cyber law is coming. It covers your IT provider.

What's happening

On Monday 26 October, the House of Lords starts the report stage of the Cyber Security and Resilience (Network and Information Systems) Bill. It's one of the last steps before the bill goes back to the Commons and, eventually, becomes law.

The bill updates the UK's 2018 network security rules, which cover essential services like energy, water, transport and healthcare. The big change for everyone else is who else it pulls in. According to the government's own summary, it brings medium and large managed service providers into scope for the first time, along with data centres. A managed service provider is any company that runs IT for other businesses on an ongoing basis: remote IT support, managed networks, security monitoring, that sort of thing.

It isn't law yet, and a lot of the detail will come later through secondary legislation, so don't expect anything to change overnight. But the direction is clear.

Why IT providers are in the frame

Your IT provider usually has the keys to everything: admin access to your Microsoft 365, remote access to every laptop, and often the same tools and accounts across hundreds of other customers. That makes them a very attractive target. Get into one provider, and you can get into all of their clients.

The government has pointed to attacks like the one on M&S in 2025, where criminals reportedly got in by tricking someone at an outside IT supplier. It's the same pattern I see in incidents: the attacker didn't break in through the front door, they borrowed a key from someone trusted.

What changes when it becomes law

• Security duties. Providers in scope will have to put proper security measures in place for the systems their service relies on, overseen by a regulator (the Information Commission, for managed service providers).
• Fast incident reporting. Significant incidents will need an initial report within 24 hours and a fuller report within 72 hours, with the NCSC told at the same time.
• Telling customers. Managed service providers and data centres will also have to let customers who are likely to be affected know. In other words, if your provider has a serious incident, you should hear about it.

Smaller IT providers may fall outside the formal rules, so don't assume the law covers yours. That's why the questions below are worth asking either way.

What this means for your business

You don't need to do anything to comply, unless you're an IT provider yourself. But you can get the main benefit now, without waiting for Parliament. Ask your IT provider four questions:

1. What can you reach? Which of our systems and accounts do you have admin or remote access to, and who on your team can use it?
2. How is that access protected? Is multi-factor authentication on every account you use to get into our systems, including your remote support tools? (If you're not sure what good looks like, here's my guide to MFA.)
3. Would you tell us, and how fast? If you had a cyber incident that might touch our systems, when would we hear about it? Is that written into our contract?
4. Who do we call? If we have an incident, what do you do in the first hour, and what's outside your scope?

A good provider will be glad you asked and will have the answers ready. If the replies are vague, that's useful to know now rather than in the middle of an incident.

The bigger picture

Every business relies on suppliers, and attackers know it. Cyber Essentials already expects you to control who has admin access and to protect it properly, and that includes accounts your IT provider uses. If you're working towards Cyber Essentials, the four questions above are a good place to start.

Sources

• UK Parliament: Cyber Security and Resilience Bill undergoes further scrutiny in the Lords
• GOV.UK: Cyber Security and Resilience Bill, summary of the bill
• GOV.UK: Relevant managed service providers factsheet