On 12 November 2025, the Department for Science, Innovation and Technology introduced the UK Cyber Security and Resilience (Network and Information Systems) Bill (the "Bill") to Parliament.¹

Purpose of the Bill

A key aim of the Bill is to address weaknesses, inadequacies, and gaps in the UK's current cybersecurity legislation (i.e., the Network and Information Systems (NIS) Regulations 2018 ("UK NIS")). As cyber threats and attacks increase in number and complexity, there is a growing sense that the UK needs to take action to ensure entities playing a pivotal role in the UK economy are better placed to defend, respond, and recover.

The impact assessment accompanying the Bill (the "Impact Assessment")² explains that UK businesses and vital public services are increasingly targeted by hostile actors, and that UK NIS is no longer fit for purpose and must be reformed:

How will the Bill achieve its aims?

The Bill proposes amendments to UK NIS which will bring more entities within scope, equip regulators with enhanced supervisory and enforcement powers, and empower the Government to amend UK NIS in the future (i.e., to keep pace with intensifying and evolving cyber threats).

It is also worth noting that the approach being proposed in the Bill will result in some alignment with the European Union NIS2 Directive ("NIS2").⁴ This will be welcome news to entities with exposure to UK and EU cybersecurity laws.

What does the Bill propose?

Among other things, the Bill proposes to:

• Bring more sectors and services within scope of UK NIS for the first time: the expanded scope will cover entities such as those operating data centres, and managed service providers (e.g., IT helpdesks, cybersecurity services, etc.), as well as also applying to large load controllers (i.e., systems that remotely control the electricity use of smart systems). Entities which provide cloud computing services, online market places, search engines and other critical sectors (e.g., energy, transport, health and water) continue to be regulated under UK NIS following the introduction of the Bill. The Bill also proposes empowering regulators to designate a service provider as "critical", to bring them within the scope of UK NIS.

  By expanding the list of sectors and services within the scope of UK NIS, there will be an increase in the number of businesses that will be required to take steps to manage their cyber risk profile, report cybersecurity incidents, etc. The Impact Assessment explains that this is intended to protect those businesses from the effects of cyber attacks, and make them less attractive to malicious actors; in turn, this will safeguard services relied on by the public and businesses to go about their lives.

• Empower the Government to update UK NIS via further secondary legislation: the Bill will introduce powers for the UK Government to update UK NIS in the future which may include, introducing minimum mandatory security measures (e.g., technical, organisational and physical measures, and supply chain security measures, etc.) that must be implemented by in-scope entities.

  According to the Impact Assessment, this will assist with ensuring that UK NIS remains effective against the ever-changing cyber landscape, and will enable the Government to update and strengthen security requirements to bring them into closer alignment with recommendations from the UK's National Cyber Security Centre and with international best practices.

• Introduce more prescriptive incident reporting requirements: the Bill will introduce expanded incident reporting requirements, as in-scope entities will be required to notify the relevant regulator about incidents (e.g., cyber-attacks) that have, or are capable of having, a significant impact on the continuity of their services. UK NIS currently only requires notification of incidents that have actually caused disruption.

  In-scope entities will be required to submit: (i) an initial notification within 24 hours of becoming aware of a significant incident; and (ii) a full notification within 72 hours. 

  The proposed changes will have an operational and resource impact on in-scope entities; however, it will also bring the incident reporting regime closer to that established under NIS2.

• Empower the Government to give specific directions to individual entities: where necessary in the interests of national security (e.g., in the context of a cyber attack affecting an entity), the Government may direct that entity to take / not take specific actions (e.g., implement specific cybersecurity measures, provide information to the Government, restrict use of certain services or facilities, appoint a specialist for specific purposes, etc.).
• Increase maximum fines to the greater of £17 million or 4% of turnover for serious breaches: the introduction of the percentage of turnover penalty brings the potential maximum fine into line with analogous legislation, like the UK GDPR. The maximum fine for failing to comply with a direction given by the Government (discussed above) is even higher, at the greater of £17 million or 10% of turnover.

Extra-territorial reach

Providers of cloud computing services, online market places, search engines and managed services that are established outside of the UK will be required to appoint a representative within the UK, and to register with the Information Commissioner within three months of the Bill coming into force.

Time to plan ahead

The Bill completed its 1st reading on 12 November 2025 and is still in the early stages of progressing through Parliament. Businesses likely to be in-scope of the reformed UK NIS should keep a close watch on the developments and be prepared to start the compliance planning process. As the Bill progresses through Parliament, we recommend:

• Continuing to monitor for developments.
• Assessing whether the business falls within the expanded scope of UK NIS (e.g., as a data centre, managed service provider, etc.).
• Considering whether existing incident detection and reporting procedures will be sufficient in light of the Bill's more prescriptive incident reporting requirements and update procedures as necessary (e.g., to meet new 24 hour initial notification requirement).
• Conducting cybersecurity audits and assessments, and remediating gaps as necessary to ensure cybersecurity posture is robust.

Questions?

Please contact John Timmons or Joe Devine if you have any questions, or if you require assistance with the matters discussed in this article.

Emily Digby (Trainee Solicitor, United Kingdom, White & Case) co-authored this publication.

_{1 You can find a copy of the Bill here. 
2 You can access the Impact Assessment here.
3 P.5 of the Impact Assessment.
4 For more information on NIS2, you can: (i) watch our webinar which explores the key issues for organizations grappling with NIS 2 compliance; and (ii) read our alert on the transposition status of NIS 2 here.} 

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2025 White & Case LLP}