CSRB Radar — April 2026: Commons Committee Stage Cleared

Archive note — updated 21 October 2026. This article was originally published on 26 April 2026 as a dated Parliamentary snapshot. It is retained for chronology and should not be read as the current Bill position.

Position at 21 October 2026

The Cyber Security and Resilience (Network and Information Systems) Bill had completed all Commons stages and Lords Committee Stage (held in Grand Committee, 1–7 September 2026). The Lords version at that date was HL Bill 49, as amended in Grand Committee. The Bill is not law in force until Royal Assent and commencement.

Check the official Parliament Bill record.

GOV.UK's factsheet on relevant managed service providers sets out the proposed scope.

What remains useful from the April readiness view

MSPs can still prepare evidence across governance, incident-response ownership, supply-chain assurance and documented scope analysis. These are readiness workstreams based on the Bill and Secordit methodology; they are not confirmed legal thresholds.

The Bill contains a proposed penalty framework. Penalty maxima, regulator detail, scope thresholds and reporting implementation must be read from the current Bill and official secondary material rather than inferred from this historical article.

Where to go next

Not sure where to begin? Start with our Small Business Cyber Starter Checklist.

For practical groundwork alongside this, the kits cover tasks such as answering supplier security questionnaires and preparing Cyber Essentials answers.

Secordit Intelligence products are operational intelligence and compliance readiness materials. They do not constitute legal advice and do not guarantee regulatory outcomes. Buyers should verify current legal requirements against official sources and seek legal advice where required.