The Cyber Security and Resilience Bill is being read, in most boardrooms, as a legal problem. It is not. By the time a regulator asks you anything, the question will be about evidence: what you owned, when it appeared, when you knew, and what you did. That is an inventory problem wearing a legal hat.
This piece assumes you have already read the policy summaries. It deals with what the Bill demands of the internet-facing estate you actually own, including the parts of it you do not currently know about.
What the Bill Changes, and Where It Has Got To
Start with the honest position: it is a Bill. It was introduced to Parliament in November 2025 and, at the time of writing, is not law and has no commencement date you can plan around. Before you act on any timetable, check the current stage on bills.parliament.uk rather than on a summary written six months ago. Clauses change during passage, and reporting windows are exactly the sort of detail that moves.
The Bill reforms the Network and Information Systems Regulations 2018 rather than tearing up the UK framework and starting again. The shifts trailed in the Government’s policy material are wider scope, stronger and better-funded regulators, updated incident reporting duties, and a power for the Secretary of State to direct regulated entities on national security grounds. Penalties under the 2018 Regulations already reach £17 million for the most serious failures, and turnover-linked figures have been discussed during the reform process. Check the current text before you quote a number to anyone senior.
Much of the operational detail will not sit in the Act at all. It will arrive later, in secondary legislation and in sector regulator guidance. Which means clause-by-clause compliance planning now is mostly wasted effort. Plan for capability instead: the things you will need regardless of how the drafting settles.
Waiting for commencement is the expensive option, for a dull reason. Discovery and attribution work on a real estate takes months, not weeks. Finding an unfamiliar host is fast. Establishing who owns it, what it supports and who patches it is slow, because it involves people who are on leave, teams who have been restructured, and a supplier contract nobody can find.
Who Gets Pulled Into Scope, and Why Suppliers Should Read This First
Existing operators of essential services and relevant digital service providers stay in scope. The expected extension reaches managed service providers and, through a designation mechanism, critical suppliers whose failure would disrupt an essential service. Data centres have been treated as critical national infrastructure since 2024 and sit in the frame as a newer category of regulated entity.
For an MSP, this changes the conversation permanently. You hold privileged remote access into client networks. Your external estate is so part of your clients’ risk surface, and it becomes their due diligence question rather than your internal housekeeping. An exposed management console on your perimeter is not your problem alone.
If you are unsure whether you are in scope, a scoping test that works before the detail lands: list the services you run, name who depends on them and what breaks if they stop, then mark which of those services are reachable from the public internet. The overlap between the second and third columns is where regulatory attention will concentrate.
Reporting Clocks Turn Inventory Gaps Into Regulatory Gaps
The model trailed in the Government’s policy material is two-stage: a short initial notification to the regulator and the NCSC, followed by a fuller report within a few days, with a duty to inform affected customers. The proposal discussed during consultation was 24 hours for the initial notification and 72 hours for the full report. Verify the hours against the current version of the Bill, not against an older policy statement, because those numbers are precisely what committee stages tend to adjust.
Whatever the final figure, the mechanics matter more than the number. A short clock is an attribution problem before it is a legal one.
Consider how the first hours actually go. An alert names a host. Nobody recognises the hostname. Someone checks the CMDB and finds nothing, which proves nothing, because the CMDB only records what was provisioned through process. Is it yours, a supplier’s, or an impersonation domain someone registered to phish your customers? Three people spend four hours on that question. The clock has been running the whole time.
Change detection with first-seen and last-seen dates converts that argument into a timeline. The difference between “we believe exposure began around then”and “this host first appeared in our external view on 14 March and the certificate changed on 2 April”is the difference between a statement you can defend and one you cannot. Regulators want it. So do insurers.
Three things to have ready before you need them: a named decision-maker with authority to notify out of hours, a pre-agreed notification template that does not require legal sign-off on structure, and an asset register that answers “is this ours?”in minutes rather than days.
Proving “Appropriate and Proportionate”Starts With an Accurate External Inventory
The phrase “appropriate and proportionate”is unprovable without an accurate internet-facing asset register. You cannot demonstrate that your measures were proportionate to your risk if you cannot describe the surface the risk applies to. And the register most organisations already hold was built from provisioning records, which is to say it records what the process knew about.
It does not record the campaign microsite a marketing agency stood up in 2021. Or the acquired company’s legacy domains, still resolving, still branded. Or the developer’s cloud test environment that was meant to last a fortnight. None of these is exotic. They are the ordinary sediment of an organisation that has existed for a few years and moved quickly.
External discovery works the other way round: from the outside, the way an attacker does. Starting from a seed domain, it expands through certificate transparency logs, DNS records including subdomain enumeration, domain registration data and IP allocation records, then tests what responds. The mechanics of working outward from a seed domain to a usable inventory are worth understanding before you buy anything, because the output is not what people expect.
The output is a list of candidates, not certainties. A certificate bearing your brand name might belong to a partner, a former subsidiary, or someone impersonating you. The tool infers association; it does not confirm ownership. Which leads to the part that matters for the Bill: the ownership decision you make about each candidate is itself the compliance evidence. A record saying who owns an asset, which service it supports, who patches it and when that was last confirmed is exactly what a regulator asks for after an incident. The fields worth recording against each confirmed asset are unglamorous and they are the artefact.
External attack surface management does not replace vulnerability management or your internal tooling. It answers a different question: what exists out there with your name on it. Authenticated internal scanning still tells you far more about each host. Both, not either.
The Exposures a Post-Incident Review Will Ask About Beyond CVEs
Patch records are the easy part of the file. The findings most likely to be picked apart afterwards are rarely CVEs at all.
Exposed management interfaces. An administrative console, a remote access panel, a file transfer appliance, published to the whole internet rather than restricted to an office range or behind a broker. Edge devices are the clearest case: VPN concentrators, gateways and file transfer appliances have driven repeated NCSC advisories, and on those devices the gap between disclosure and exploitation is measured in days. A readiness routine for patch waves starts with knowing which of those appliances you have on the perimeter at all.
Certificate hygiene. Expired certificates on customer-facing services, hostname mismatches, a wildcard issued years ago and now installed on hosts nobody tracks. None of these is a breach. All of them quietly undercut assurances you have given customers in writing, and all of them are visible to anyone who looks.
Dangling DNS. Take the marketing site. A campaign runs on a cloud bucket, the campaign ends, the bucket is deleted, and promo.example.co.uk keeps its CNAME pointing at a resource that no longer exists: a pointer to nothing. Months later someone else registers that bucket name, claims the target, and serves content from a subdomain your customers trust. Phishing from your own brand, on your own DNS. Ask the awkward questions now, because they are harder mid-incident. Whose incident is it? Yours, because the record is yours. Is it reportable? Very possibly, if customer data or an essential service is affected. What closes it? Deleting one DNS record. The mechanics of subdomain takeover are simple; the reason it persists is that nobody owns stale DNS.
Likely versus definitely. Passive external observation infers a version from a banner or a fingerprint. It tells you a system is likely affected. Active testing proves it definitely is. That distinction is fine in a weekly report and dangerous in an incident report submitted under a 24-hour clock. Decide in advance which finding types get escalated to a confirmed check before they reach a regulator, because reporting on a banner and being wrong is its own kind of problem, and you will have spent the hours anyway.
A Readiness Routine You Can Start Before Commencement
Match your monitoring cadence to the reporting duty you expect. A quarterly scan against a duty measured in hours makes no sense: it leaves a window in which new exposure lives undetected and, worse, undated. When the question is “when did this appear?”, a point-in-time scan cannot answer it. An annual assessment is a snapshot of a river.
Get the prioritisation logic right before you turn up the volume. Agree internally what counts as reportable-grade severity, in writing, before the duties bite. New obligations become a noise machine very quickly, and a small team that is triaging 400 low-severity findings is not watching the perimeter.
Change the supplier conversation now. A certificate number tells you a supplier passed an audit on a defined scope on a particular day. Ask instead: what does your external estate look like, how often do you check it, and how long did it take you to close the last exposed service you found? The answers, or the silence, are more informative than the scope statement.
For the board, three numbers are enough: confirmed external assets, unowned candidates still awaiting attribution, and mean time from an exposure appearing to it being closed. The middle number is the uncomfortable one. It is also the one that shrinks with effort, which makes it a good thing to report on quarterly.
The Short Version
The Cyber Security and Resilience Bill is not law yet, and the operational detail will arrive after it is. Do not wait. The work it will demand, an accurate internet-facing inventory with confirmed ownership and dated change history, takes months and is useful whether or not you end up in scope. Start with discovery from the outside, attribute what you find, and be honest about which findings are inferred rather than proven. Everything else is drafting.
Frequently Asked Questions
Is the Cyber Security and Resilience Bill law yet?
No. It was introduced to Parliament in November 2025 and remains a Bill at the time of writing, with no commencement date you can rely on. Check the current stage on bills.parliament.uk before planning around any deadline, because reporting windows and penalty provisions can change during passage.
Who will the Cyber Security and Resilience Bill apply to?
Existing operators of essential services and relevant digital service providers under the NIS Regulations 2018, with an expected extension towards managed service providers and critical suppliers designated so. Data centres sit in the frame as a newer category. If you run a service others depend on and it is reachable from the public internet, assume the question applies to you and confirm later.
What incident reporting deadlines does the Bill introduce?
A two-stage model has been trailed: a short initial notification followed by a fuller report within a few days, plus a duty to inform affected customers. The consultation discussed 24 hours and 72 hours respectively. Verify the exact wording against the current version of the Bill rather than an older policy statement.
How is the Bill different from the NIS Regulations 2018?
It reforms the 2018 Regulations rather than replacing the UK framework. The direction of travel is wider scope, stronger regulator powers and funding, updated reporting duties and a national security direction power for the Secretary of State. The underlying duty to take appropriate and proportionate measures is not new; the enforcement around it is being tightened.
What should we do now, before the Bill takes effect?
Build the external inventory and the attribution record, because those take the longest and are useful regardless. Run discovery from outside the network, decide ownership for every candidate it returns, record first-seen dates, and agree in advance which findings get confirmed by active testing before they enter any report. Then ask your suppliers the same questions.