error
Subscriptions are not available for this site while you are logged into your current account.
close
Skip to main content
Submit RFP

      The UK Cyber Security and Resilience Bill (CSRB) represents the most significant expansion of UK cyber regulation in recent years, introducing broader regulatory scope, enhanced supervisory powers and higher expectations for organisational resilience. The CSRB will bring a wider range of organisations into scope while raising expectations for those already subject to cyber regulation. Understanding the implications now will help organisations prepare for implementation and future regulatory scrutiny.

      An expanded perimeter and higher expectations

      While the technical details will follow through secondary legislation and codes are Royal Assent, one thing is clear: The CSRB is not a light-touch update to the UK’s existing NIS framework. It marks a genuine departure from previous regulation, introducing differences in scope, speed and enforcement that organisations cannot address through existing compliance programmes alone. Companies operating across sectors such as water and transport remain in scope, whilst applicability now extends to data infrastructure, managed service provider, large load controllers and selected critical suppliers. Furthermore, the CSRB places a greater emphasis on governance and resilience, as it intends to drive board-level accountability, resilience testing and exercising and risk-based security management.

      Janina Herrmann

      Director, Consulting Cyber and Resilience

      KPMG in the UK

      What are the highlights?

      • Scope and oversight has expanded

        The CSRB widens the regulatory perimeter well beyond existing Operators of Essential Services (OES) and Relevant Digital Service Providers (RDSPs), pulling in medium and large managed service providers, qualifying data centres, large load controllers above 300 megawatt and regulator-designated Critical Suppliers. Many companies will be in scope for the first time.

      • Incident reporting must be faster

        The CSRB updates incident reporting to give authorities earlier visibility and improve sector-wide coordination. Regulated entities must submit a light-touch notification within 24 hours, a full report within 72, and inform the NCSC alongside their regulator. You need to move fast, even if there’s been no disruption. 

      • Regulatory powers have expanded

        The CSRB equips competent authorities with a stronger toolkit: enhanced powers to inspect, demand information and enforce compliance, all backed by cost-recovery provisions that let regulators fund oversight through fees. A Statement of Strategic Priorities will guide how those powers are used. Expect enforcement to carry financial and reputational weight.

      • Convergence on fundamentals prioritised

        The CSRB does not sit in isolation. Regulators across the EU, Australia and the US are converging on the same outcomes: board awareness, risk assessment, business continuity, supply-chain security and incident reporting. Maintaining separate programmes for every market is no longer a sustainable strategy for multinationals.

      Preparing will not be easy: three big buckets of considerations

      As the CSRB broadens its scope, accelerates deadlines and intensifies regulatory oversight, organisations are confronted with a heightened array of challenges.

      Governance:

      Governance challenges start with understanding scope and applicability across multi-entity, cross-border structures, then managing the increased workload of 24- and 72-hour deadlines. Adding to the complexity are rising costs from managing budgets across parallel regimes, difficulty achieving executive buy-in and the challenge of transitioning from a one-off project to business as usual.

      Risk management:

      Organisations should prepare for several practical challenges:

      • Strengthening incident detection and response capabilities to support accelerated reporting timelines.
      • Improving security governance across operational technology (OT) and legacy environments.
      • Enhancing third-party and supply chain risk management processes.
      • Reviewing supplier contracts, oversight arrangements, and resilience expectations.
      • Demonstrating that cyber risks are managed consistently across the organisation.

      Technical:

      Technical challenges span penetration testing expectations that will tighten before methods are formally mandated, legacy constraints where older platforms cannot support modern controls, weak asset visibility across IT, OT, cloud and third parties, and gaps in logging and monitoring that threaten notification timelines.

      Five key lessons from our experience

      At KPMG, our teams have extensive experience helping organisations like yours to prepare for the impacts and implications of the CSRB. Here are five lessons we’ve learned from that experience.

      • Design for convergence:

        Do not build a bespoke the CSRB programme in isolation. Mapping controls against NIS2, SOCI, DORA and other regimes reveals shared ground, allowing a single integrated control architecture to replace separate initiatives. Convergence reduces cost, cuts duplication, and keeps you resilient as more jurisdictions add requirements.

      • Plan for iteration:

        Secondary legislation and codes of practice are still to come, so treat your programme as a living one rather than a finished project. Maintain a regulatory change log, deliver no-regret capabilities now, and expect to adopt final codes with minimal rework rather than starting again.

      • Integrate suppliers:

        Suppliers are no longer external parties under the CSRB; they are increasingly viewed as part of the wider resilience ecosystem. Build a structured third-party risk management programme that extends beyond direct suppliers to include critical fourth-party dependencies where appropriate. Organisations can draw valuable lessons from DORA implementation programmes, particularly around supplier oversight, resilience testing, concentration risk and information-sharing arrangements.

      • Understand your MVC:

        Define your Minimum Viable Company before disruption forces the question. Knowing which core services must keep running, and the minimum capability required to sustain them, gives you a business-led basis for prioritising investment and making faster, clearer recovery decisions when an incident hits.

      • Go beyond compliance:

        Treating the CSRB as a technology or cyber compliance exercise alone misses the point. The organisations most likely to succeed will embed resilience into business governance, risk management and operational decision-making. Ownership should extend beyond security teams to include compliance, legal, risk and executive leadership functions, reflecting the CSRB's broader business resilience objectives.

      How KPMG can help

      The UK CSRB represents a deliberate step-change in the UK's cross-sector cyber regime: it widens the perimeter, accelerates incident visibility and equips regulators to steer and scrutinise outcomes more effectively.

      Our teams operate end-to-end, from scoping and dependency mapping through to full-scale implementation to help organisations go beyond compliance to achieve long-term cyber and business resilience.

      Check out our cyber services website here or contact your trusted KPMG advisor to learn more.

      Download UK cyber resilience bill

      UK Cyber Resilience Bill

      A practical guide to the UK Cyber Security & Resilience Bill (CSRB), outlining key regulatory changes, expanded scope, incident reporting requirements, governance expectations, and cyber resilience obligations for organisations.

      Download

      Our advisory insights

      Something went wrong

      Oops!! Something went wrong, please try again
      MTD

      Get in touch

      Discover why organisations across the UK trust KPMG to make the difference and how we can help you to do the same.

      Contact us