The UK government is rewriting the rules on cyber security. The Cyber Security and Resilience Bill, currently working its way through Parliament, represents the biggest overhaul of cyber legislation since the original NIS Regulations landed in 2018. And while the headlines focus on critical infrastructure and big-name operators, the ripple effects for small and medium-sized businesses are going to be significant.
If you run a business with 20 to 100 staff, especially in manufacturing, construction, engineering or entertainment, this is something you need on your radar right now. Not because the government is about to fine you into oblivion, but because the way your clients, suppliers and IT partners operate is about to change. And you need to be ready.
First introduced to Parliament in November 2025, the Bill reforms the existing Network and Information Systems (NIS) Regulations. It passed its second reading in January 2026 and has been progressing through committee stage since February.
The original NIS Regulations covered operators of essential services like energy, transport, water and healthcare, plus some digital services such as cloud providers and online marketplaces. The new Bill expands that scope considerably and tightens the requirements for everyone involved.
At its core, the Bill does three things that matter for UK businesses:
The government has been clear about the context. 32% of UK businesses reported a cyber breach or attack in the last year. The NHS ransomware attack in 2024 disrupted over 11,000 appointments. Cyber incidents are costing the UK economy billions annually. This Bill is the response.
This is the headline change for most SMBs. An estimated 900 to 1,100 managed service providers across the UK will come under direct ICO oversight. That means your IT provider, if you use one, will need to meet defined security standards, report incidents within strict timeframes, and demonstrate compliance.
For businesses that outsource their IT, this is actually good news. Your provider will be held to a higher standard. But it also means you need to start asking the right questions:
A good IT partner will already be working toward compliance and will welcome these questions. If your provider gets defensive or cannot give you straight answers, that tells you something important.
Under the old NIS Regulations, incident reporting was inconsistent. Different sectors had different timelines and different thresholds for what counted as reportable. The new Bill standardises everything.
Organisations in scope must now:
That is a tight window. And while most SMBs will not be directly in scope, think about what happens when your IT provider has an incident that affects your systems. You will want to know about it fast. You will want a provider who has the processes in place to detect, respond and communicate quickly.
If your business handles data for a larger client who is in scope, their reporting obligations become your problem too. They will need you to be transparent and fast when things go wrong.
Here is where things get real for businesses of all sizes. The Bill requires regulated organisations to assess and manage cyber risk across their entire supply chain. That means if you supply products or services to any larger business that falls under these regulations, expect the following:
This is already happening. Manufacturers in sectors like construction, engineering and entertainment are seeing larger clients tighten their vendor requirements. The Bill will accelerate this trend significantly.
The businesses that get ahead of this curve will win contracts. The ones that do not will lose them. It is that straightforward.
For organisations directly in scope, the penalties are substantial:
Most SMBs will not face these fines directly. But here is the thing: losing a contract because you cannot satisfy a client’s supply chain requirements has the same practical impact at a smaller scale. If your biggest client drops you because you cannot demonstrate basic cyber hygiene, the financial hit is real.
This Bill is not happening in isolation. The UK cyber threat landscape has shifted dramatically in the last 18 months:
The government’s own DSIT newsletter from March 2026 reinforced the urgency, noting that cyber incidents continue to affect a large proportion of UK organisations. The NCSC has issued fresh guidance urging businesses to review their security posture.
You do not need to wait for the Bill to receive Royal Assent. The direction is clear, and the expectations are already filtering into commercial contracts. Here is your practical action plan:
Cyber Essentials is the government-backed certification that demonstrates you have the basics covered. It addresses five key controls: firewalls, secure configuration, user access control, malware protection and patch management. It is proportionate, affordable and increasingly expected by larger clients. If you do one thing on this list, make it this.
Multi-factor authentication (MFA) should be enabled on every account in your business, not just email. Cloud platforms, remote access tools, accounting software, CRM systems. If it has a login, it needs MFA. Weak passwords and unpatched identity tools are expected to fuel 30% of breaches in 2026.
If something goes wrong, do you know who to call? What to do in the first hour? How to communicate with clients? An incident response plan does not need to be a 50-page document. It needs to be practical, tested and accessible to the right people. At minimum, cover:
If you use an external IT company, schedule a conversation about the Bill. Ask them:
Your IT partner is about to become a regulated entity. Make sure they are treating that seriously.
Ransomware attacks against UK SMBs are expected to rise by 20% this year, partly because public sector ransom payment bans will push attackers toward private businesses. Your last line of defence is a solid backup strategy. Make sure you have:
With AI-powered phishing becoming nearly indistinguishable from legitimate emails, your team is both your biggest vulnerability and your strongest defence. Regular security awareness training does not need to be expensive or time-consuming. Even quarterly 15-minute sessions covering the latest threats can dramatically reduce your risk.
It is tempting to see new regulation as just another burden. But there is a genuine opportunity here for businesses that act early.
Businesses that can demonstrate solid cyber security practices will stand out in tender processes. They will retain larger clients who are tightening their supply chains. They will avoid the disruption and cost of a breach. And they will be better positioned for cyber insurance, which is becoming harder and more expensive to obtain without evidence of good practices.
The government has been clear that SMBs are not expected to invest in enterprise-grade tools. The expectation is proportionate: understand your risks, take reasonable steps to manage them, and be able to show evidence of both.
The Bill is currently in the committee stage in the House of Commons. After that, it moves to report stage, third reading, then the House of Lords. While exact timelines depend on parliamentary scheduling, the expectation is that the Bill could receive Royal Assent later in 2026, with implementation following.
But smart businesses are not waiting for Royal Assent. The supply chain requirements and client expectations are already here. The best time to prepare was six months ago. The second-best time is now.
At Magnetar IT, we have been helping UK businesses navigate cyber security challenges for over 10 years. We combine hands-on IT support with software development and cyber security expertise, which means we can help you not just meet compliance requirements but genuinely strengthen your defences.
Whether you need help with Cyber Essentials certification, a security audit, incident response planning, or just want a straight conversation about where your business stands, we are here.
With 89% of issues resolved within the first hour and a 98% customer satisfaction rate, we do not just talk about responsive support. We deliver it.
Get in touch today for a free cybersecurity consultation and find out how ready your business really is. Do not wait for the legislation to catch up. Get ahead of it.
Date: June 30, 2026
Author: Rafael Macedo