let's talk

New UK Cyber Law – What It Means for Businesses That Outsource Their IT

cyber security and resilience bill

If you outsource your IT to a managed service provider (MSP), a new UK law is heading your way – and it’s good news for you.

The Cyber Security and Resilience Bill is currently going through the House of Lords, with Royal Assent expected later this year. For the first time, it brings managed IT service providers into the UK’s cyber security regulations.

Why MSPs are being regulated

IT providers hold the keys to many businesses at once – remote access, admin passwords, network connections. That makes them an attractive target. One successful attack on a poorly secured provider can spread to every client it looks after.

The Government’s answer is to update the existing NIS Regulations (from 2018) so that “relevant managed service providers” have legal duties around security, just like energy, transport and digital infrastructure companies.

What the Bill will require of IT providers

  • Proper security standards: Providers in scope must manage cyber risk to a recognised standard, not just do their best.
  • Fast incident reporting: A significant cyber incident must be reported to the regulator and the National Cyber Security Centre (NCSC) within 24 hours, with a full report within 72 hours.
  • Telling customers: Clients affected by an incident must be told.
  • Real penalties: Serious failings could bring fines of up to £17 million or 4% of global turnover.

When does it apply?

Not overnight. Once the Bill becomes law, the detail – including exactly which providers are covered – will be set out in further regulations after consultation. Most commentators expect the main duties to take effect from around 2028.

But the direction is clear, and customers don’t need to wait for the law to expect these standards now.

6 questions to ask your IT provider

  1. How do you secure your own access to our systems? (Look for MFA and privileged access controls.)
  2. Do you hold Cyber Essentials or Cyber Essentials Plus?
  3. If you had a security incident, how quickly would you tell us?
  4. How do you keep our devices and software patched?
  5. Where are our backups, and when were they last tested?
  6. Are you preparing for the Cyber Security and Resilience Bill?

If your provider struggles to answer, that’s a warning sign.

Our commitment at E-telegence

At E-telegence, we’re not waiting for the regulations to land. We already apply strong security controls to how we access and manage client systems, and we’re building our processes around the Bill’s principles – secure access, fast incident response and clear communication with our clients.

If you’re a business in Falkirk, Stirling or anywhere in Central Scotland and want an IT partner that takes security seriously, our managed IT support plans start from £20 per user per month.

Want a second opinion on your current IT setup? Talk to our team – no obligation.

Sources: Compliance Hub – Cyber Security and Resilience Bill, Lords committee stage; JumpCloud – What the Bill means for MSPs

Share:

More Posts