top of page
Search

The UK Cyber Security & Resilience Bill: What it Means for Vulnerability Operations (VulnOps)

Sep 23
8 min read

Updated: Sep 30

The Cyber Security and Resilience Bill is the most significant overhaul of UK cyber law in almost a decade, and it explicitly reinforces the need for mature vulnerability management. We look at what changes with the introduction of these new regulations, how the NCSC's Cyber Assessment Framework (CAF) will be used to assess it, and how organisations can improve their cyber security with supporting evidence that will satisfy regulatory demand.



Matt Austin | Client Portfolio Lead | Automiq

Author:

Matt Austin

Client Portfolio Lead



On 12th November 2025, the Cyber Security and Resilience (Network and Information Systems) Bill was introduced to Parliament, marking the most substantial rewrite of UK cyber security law since the Network and Information Systems Regulations 2018 came into force. [1][3]


It lands at a point in time when the operational case for change is beginning to be made. As we set out in An Introduction to VulnOps and Patching Vulnerabilities in the Age of Frontier AI, Mythos and other Frontier AI models have drastically compressed the window between vulnerability disclosure and exploitation - this Bill adds a regulatory driver to what is already a high priority activity for most UK enterprises.


The Bill calls for robust, evidenced vulnerability management to become a legal expectation for a considerably wider set of UK organisations, with reporting clocks and financial penalties attached. [1][3][6] This article covers what the Bill changes, how compliance will be assessed, and why a policy document alone will not be enough to satisfy it.


UK cyber security and resilience bill - what it means for VulnOps

What's new in the UK Cyber Security & Resilience Bill?


The Bill amends the NIS Regulations 2018, which since Brexit have been the UK's only cross-sector cyber security law, covering operators of essential services - energy, transport, health, drinking water and digital infrastructure - and certain digital service providers. Three gaps in that regime forced the update, and each closes a loophole that has already caused a nationally significant incident: [1][2][6]


  • Managed service providers were previously outside of scope. A “Relevant Managed Service Provider” (broadly, a business of 50 or more employees, or turnover above €10m), that provides ongoing management of a client's IT systems is now formally included and will be regulated by the Information Commissioner's Office.

  • Data centres are to be added as Critical National Infrastructure in their own right.

  • A new Designated Critical Supplier mechanism lets a competent authority regulate a third-party supplier directly, wherever an incident affecting that supplier could significantly disrupt an essential service it supports.


The government has also given itself delegated powers to extend the framework to new sectors through secondary legislation, rather than needing further primary legislation each time - a direct response to a prior way of working that could not adapt quickly enough to incidents like those affecting Capita and Advanced, which fell just outside its perimeter. [1][6]


The 24 and 72 hour reporting clock


Where the current regime permits a flexible 72-hour window, the Bill replaces it with a mandatory two-stage process:


  1. An initial notification to the relevant competent authority within 24 hours, followed by

  2. A full report within 72 hours, with the NCSC notified concurrently. Digital service providers and data centre operators must also notify affected customers directly. [6]


There is also a change in the definition of what must be reported. The new Bill includes incidents “capable of having” a significant impact, not only those that already have - explicitly including ransomware that has encrypted systems pending payment, and pre-positioning events where an attacker has established covert access for later use. [6] 


Having a governed vulnerability operations (VulnOps) loop can help to mitigate weaknesses in your technology estate, and close the attack window before it becomes reportable at all.


What it will cost to get this wrong


The Bill replaces the existing four-tier penalty model with two bands:


  • Up to £17 million or 4% of global turnover (whichever is higher) for serious breaches

  • Up to £10 million or 2% of global turnover for less serious breaches, with daily fines of £100,000 for continuing non-compliance with a regulatory direction. [6] 


Regulators also gain new investigatory powers, including the ability to undertake proactive vulnerability assessments of their own - meaning an organisation's exposure may be tested directly by the regulatory authority rather than relying on self-reporting mechanisms. [6]


The Cyber Assessment Framework (CAF) - how compliance will be assessed


The Bill itself sets obligations in deliberately outcomes-based language, rather than prescribing specific technical controls. The operational detail sits with the NCSC's Cyber Assessment Framework (CAF), now at version 4.0, which is the mechanism competent authorities will use to assess whether an organisation is meeting its obligations. [5][6]


CAF applies the framework as 41 individual outcome assessments, grouped under four objectives and fourteen principles, each judged Achieved, Partially Achieved or Not Achieved against published Indicators of Good Practice (IGPs): [5]


Objective
What it covers

A — Managing security risk

Governance, risk management, asset management, supply chain

B — Protecting against cyber attack

Service protection, identity and access control, data security, system security, resilient networks, staff awareness

C — Detecting cyber security events

Security monitoring, threat hunting

D — Minimising the impact of incidents

Response and recovery planning, lessons learned

Vulnerability management sits predominantly under Objective B, but a comprehensive programme also contributes to achievement of each of the other objectives:


  • Objective A: to effectively manage security risk, organisations must understand their technology estate. The same reconciled asset ownership we cover in What is Service Mapping, and why does it matter to enterprises? is critical not only to evidencing this, but in making evidence-based decisions around the priority and potential impact of vulnerabilities.

  • Objective C: vulnerability scanning is a capability most large enterprises have in place today, as are intrusion detection systems. What most organisations are lacking is the closed loop that takes the discovery of a new vulnerability through to verified closure - preventing its exploitation.

  • Objective D: were a vulnerability to be exploited, being able to close the window via automated methods significantly shortens the attack window, and therefore the likely impact of the resulting incident.


Why a policy document will not be enough


CAF assesses evidence of outcomes, not the existence of a policy. An Indicator of Good Practice (IGP) asks an assessor to look for demonstrated practice: who owns it, what happened, and how it was verified.


This is where the distinction we set out in An Introduction to VulnOps becomes directly relevant to compliance, not just security. A policy that says “critical vulnerabilities are patched within 14 days” is not evidence. A record showing observed exposure hours, an independently verified rescan, a named executor and verifier, and a policy version, is exactly the evidence that regulators will want to see.


If you are not in scope today, read this anyway


Retail and automotive manufacturing sit outside the Bill's current scope. Marks & Spencer's 2025 disruption and the estimated £1.9 billion cost of the Jaguar Land Rover attack in the same year both fall into that gap, and both are cited as the clearest argument for closing it. [6] The Secretary of State's power to designate new sectors through secondary legislation means that gap is more likely to narrow than to persist.


Equally, the Designated Critical Supplier mechanism incorporates supply chains that were never directly regulated: a supplier does not need to be an operator of essential services itself to be brought into scope, only to matter enough to one. [6]


The NCSC's own advice is not limited to regulated entities - it addresses “all organisations, irrespective of size.” [4] Waiting for a Code of Practice to confirm applicability only delays the inevitable - and increases organisational risk the longer the work remains undone.


What enterprises should do now - and how Automiq can help



The bottom line


The Bill will not require any organisation to formally adopt VulnOps as a methodology, nor will the term appear in a Code of Practice. What it will require, through CAF and review by a competent authority, is a named owner, a demonstrated response, and independent proof that it worked.


A governed VulnOps loop enforces this by design. Firms already running one will find most of what a CAF assessment asks for is a natural output of their day-to-day operations. Organisations relying on a policy document will find the gap between having a rule and being able to prove compliance is exactly where the Bill's penalties sit.


Frequently asked questions


What is the Cyber Security and Resilience Bill?

It is UK legislation, introduced to Parliament on 12 November 2025, that amends and substantially extends the Network and Information Systems Regulations 2018. It expands the range of organisations subject to cyber security regulation, introduces a faster incident reporting regime, and strengthens enforcement, bringing UK law closer to the EU's NIS2 Directive. [1][3][6]


Does the Bill apply to managed service providers?

Yes. A “Relevant Managed Service Provider” - broadly, an organisation of 50 or more employees or turnover above €10 million, providing ongoing management of a separate organisation's IT systems - is brought into scope for the first time, regulated by the Information Commissioner's Office. [6]


What are the incident reporting timelines under the Bill?

An initial notification to the relevant competent authority within 24 hours of becoming aware of a reportable incident, a full report within 72 hours, and concurrent notification to the NCSC. Digital service providers and data centre operators must also notify affected customers. “Reportable” now includes incidents capable of having a significant impact, not only those that already have. [6]


What penalties does the Bill introduce?

A two-band structure: up to £17 million or 4% of global turnover for serious breaches, up to £10 million or 2% for less serious ones, and daily fines of £100,000 for continuing non-compliance with a regulatory direction. [6]


What is the NCSC Cyber Assessment Framework, and how does it relate to the Bill?

CAF is the NCSC's assurance framework, applied as 41 individual outcome assessments grouped under four objectives and fourteen principles, that competent authorities will use to assess whether a regulated organisation is meeting the Bill's requirements. Version 4.0, released in August 2025, added guidance on software supply chain risk, threat hunting and AI governance. [5][6]


Are we affected if we are not currently regulated under the NIS Regulations?

Possibly, and increasingly likely over time. The Bill gives the Secretary of State delegated powers to bring new sectors into scope through secondary legislation, and its Designated Critical Supplier mechanism can reach organisations that supply into a regulated sector without being regulated themselves. The NCSC's guidance on preparing for the vulnerability patch wave is explicitly addressed to organisations of every size, not only those currently in scope. [4][6]


When does the Bill come into force?

As of September 2026, the Bill is progressing through the House of Lords and has not yet received Royal Assent. Most operational requirements are expected to follow through secondary legislation and phased commencement afterwards, with a consultation period before detailed rules are finalised. Organisations are advised to prepare against CAF v4.0 now rather than wait for that process to complete. [3][6]


How does VulnOps help demonstrate compliance with the Bill and CAF?

VulnOps produces, as a normal output of running the discipline, the evidence CAF actually assesses: a named owner for each decision, a controlled execution route, and independent verification that an exposure is closed, all timestamped and recorded against a policy version. See An Introduction to VulnOps for how that loop works.


Sources and further reading


Automiq logo light
bottom of page