After Lords Committee Stage: What MSPs should know about the CSRB

Position checked at 30 September 2026

The House of Lords Grand Committee completed its detailed examination of the Cyber Security and Resilience (Network and Information Systems) Bill on 7 September. Parliament’s current Bill page lists HL Bill 49, as amended in Grand Committee, dated 7 September. Lords Report Stage is scheduled for 26 October.

The Bill is still before Parliament. It has not received Royal Assent, and the proposed new Relevant Managed Service Provider (RMSP) regime is not in force.

What did Committee Stage mean for MSPs?

Committee Stage is a line-by-line examination where members can consider and agree amendments. The practical point for an MSP is that the text has moved on from the version brought from the Commons. If you are tracking the proposal, use the latest official Bill version rather than an old PDF or a third-party summary.

That does not mean the committee has answered every operational question. The Government’s RMSP factsheet says the proposed measure would be brought into force through secondary legislation following Royal Assent. Additional security and resilience requirements and thresholds for significant incidents are among the details expected through later regulations.

Three things to keep separate

1. Proposed category: the Bill describes an RMSP framework for providers of managed services in the UK, with micro and small enterprises excluded from this specific category subject to statutory exceptions. A provider’s service model and access to customer systems matter; “MSP” as a label alone is not a complete scope test.
2. Proposed duties: the policy model includes registration, proportionate security measures and reporting of qualifying significant incidents. These are not new duties in force under this Bill as at 30 September.
3. Implementation detail: commencement and operational requirements depend on further legislation and regulations. Reporting thresholds and detailed requirements should not be guessed from draft wording.

A useful monthly check

Record the date and version of the official text you reviewed. Keep a short list of questions that affect your business: which ongoing services involve management of customer systems; what systems support those services; who owns incident records and escalation; and which details are still awaiting regulations or guidance.

This creates a traceable starting point without treating a proposed regime as an immediate compliance deadline. It also makes it easier to update your internal view when the Bill or official materials change.

What to watch in October

Report Stage is scheduled for 26 October and offers another opportunity for scrutiny and changes. Watch the amendments and the text that follows the debate. Do not assume in advance that a particular amendment will be made or that passage at Report Stage would itself bring the proposed MSP duties into force.

For a concise, source-linked overview, get the free MSP briefing. For a structured internal baseline, CSRB-BRIDGE is a self-serve readiness framework using Secordit methodology; it does not determine official scope or guarantee compliance.

Sources: UK Parliament Bill page and current text; Bill stages; GOV.UK RMSP factsheet.

Secordit Intelligence products are operational intelligence and compliance readiness materials. They do not constitute legal advice and do not guarantee regulatory outcomes. Buyers should verify current legal requirements against official sources and seek legal advice where required.