The Cyber Security and Resilience Bill: What You Need to Know Now
The Cyber Security and Resilience Bill: What You Need to Know Now
https://www.infosecurity-magazine.com/opinions/uk-cyber-bill-what-ot-it-needs-now/
Publish Date: 2026-04-03 06:01:00
Source Domain: www.infosecurity-magazine.com
The UK is making its most significant overhaul of cybersecurity regulations in nearly a decade, and operational technology (OT) asset owners are watching closely.
Introduced in November 2025, the Cyber Security and Resilience Bill (CSRB) is the biggest change to UK cybersecurity regulations since the Network and Information Systems (NIS) regulations went into effect in 2018. More than just an update to that framework, it fundamentally shifts regulatory expectations to reshape how critical infrastructure operators manage, report and mitigate cyber risk.
Among the biggest changes: under CSRB, almost all OT systems are now firmly in scope as “national resilience” assets.
As the bill moves its way through Parliament, now is the time to understand what’s likely to be required and begin preparing. For example, we know incident reporting is coming. Ahead of specifics, you can determine who should make which decisions and how information should flow.
This article breaks down what the CSRB is, where it stands in the legislative process, and what its key provisions mean for newly in-scope asset owners. We’ll also look at how the National Cyber Security Centre’s (NCSC) Cyber Assessment Framework (CAF) fits into the picture and outline how organisations can prepare.
Understanding the CSRB: What It Is and Where It Stands
The CSRB builds on NIS, which introduced the UK’s first clear legal responsibilities for OT asset owners in 2018. It sets expectations for cybersecurity preparedness that operators of essential services must meet. Eight years later, technology, geopolitics and the threat landscape have all evolved, and the government is modernizing its approach.
Incident Reporting, Enforcement and Oversight
The CSRB introduces new legal requirements meant to strengthen national resilience, expand regulatory scope and establish a more robust — and enforceable — set of expectations.
For organizations that are already in scope under NIS, the biggest…
