Secordit Intelligence logo and the headline “PROPOSED MSP SCOPE” on a dark panel fading into a photo of hands with a notebook, phone and tablet on a meeting table.

Is Your MSP in Scope for the Cyber Security and Resilience Bill?

If you run a UK managed service provider, the question "does the Cyber Security and Resilience Bill apply to us?" is probably the single most urgent thing on your compliance radar right now. The Bill proposes a new legal category — the Relevant Managed Service Provider, or RMSP — and if your business falls into it once the relevant provisions commence, it would have new registration and security duties to meet. This article walks through exactly what an RMSP is, the in-scope and exempt criteria published by GOV.UK, a practical self-assessment checklist, and what's still genuinely unresolved.

What Is an RMSP?

According to the GOV.UK "Relevant managed service providers" factsheet (last updated 30 June 2026), the Cyber Security and Resilience Bill amends and expands the existing Network and Information Systems (NIS) Regulations 2018 — it does not replace them outright. Within that expanded framework, it creates a new regulated category: the Relevant Managed Service Provider.

An RMSP is a provider of managed services in the UK, and a managed service is defined as the ongoing management of a customer's IT systems under contract, where the provider connects to, or otherwise obtains access to, the systems the customer relies on. That includes activities such as:

  • Support and maintenance of client IT systems
  • Monitoring of client environments
  • Active administration of client infrastructure, whether delivered on-premises or remotely

This is a deliberately broad definition aimed at capturing the day-to-day reality of managed service delivery — not just a narrow slice of it. If your contracts involve ongoing, active management of a client's IT systems rather than one-off project work, you are exactly the kind of business this category was written to describe.

Who's In Scope, and Who's Exempt

The factsheet sets out both sides of the line reasonably clearly, even though some of the fine detail is still pending (more on that below).

In scope

Medium and large MSPs providing UK managed services fall within the RMSP category as currently described. If your business meets the ongoing-management definition above and isn't a small or micro enterprise, you should assume you are being asked to plan as if this applies to you.

Exempt

Small and micro enterprises are exempt. So are entities subject to public authority oversight that get less than half their income from commercial activities. The factsheet also explicitly excludes several categories of provider from the RMSP definition:

  • Data centre services — providing a data centre service, as defined by the Bill, doesn't on its own make you an RMSP
  • Public electronic communications networks and services — already regulated under separate frameworks
  • Pure operational-technology (OT) management without IT management — providers managing OT alone, without an IT management component, fall outside the RMSP definition

If your business sits in one of these excluded categories, the RMSP duties described below won't apply to you directly, though you may still need to consider other parts of the Bill depending on your services.

Self-Assessment Checklist: Are You Likely an RMSP?

Based directly on the GOV.UK criteria above, ask yourself the following. This isn't a legal determination, but it will give you a structured read on where you likely sit.

  • Do you provide ongoing (not one-off) management of client IT systems under a contract?
  • Does that management include support, maintenance, monitoring, or active administration — delivered either remotely or on-site?
  • Is your business classed as medium or large, rather than small or micro?
  • Are your managed services delivered to UK clients?
  • Is your core offering IT management, rather than data centre hosting, public electronic communications, or standalone OT management?

If you answered yes to most of these, you are likely to fall within the RMSP category once the relevant provisions commence. If you're unsure on the size threshold, the incident-notification detail, or how your specific service mix maps against the criteria, that uncertainty is exactly what a structured gap analysis is designed to resolve.

What Happens If You're In Scope

The factsheet sets out a defined set of duties for RMSPs once the relevant provisions of the Bill commence:

  • Register with the Information Commission (the regulator), providing entity details
  • Appoint a UK representative if your business is based overseas
  • Implement "appropriate and proportionate" risk-management measures
  • Keep security proportionate to risk, using state-of-the-art methods
  • Act to prevent or minimise the impact of incidents
  • Notify the regulator of "significant" incidents

Once relevant provisions commence, RMSPs get three months to register — but importantly, the security duties apply from commencement, not after registration. In other words, registration is a compliance deadline, but your underlying security obligations start on day one regardless of whether you've registered yet.

The GOV.UK incident-reporting factsheet describes a proposed two-stage process: an initial notification within 24 hours of awareness of a significant incident, followed by an incident report within 72 hours. Significant-incident thresholds and implementation detail remain subject to secondary legislation and consultation.

To write down who does what in an incident, see our First Hour After a Breach kit.

If clients are already sending you security questionnaires, our Supplier Security Questionnaire Answer Kit helps you answer them honestly and consistently.

What's Still Pending

It's important to be honest about what isn't settled yet. The GOV.UK factsheet explicitly leaves the following to secondary legislation that has not yet been published:

  • Additional security and resilience requirements: what counts as the appropriate and proportionate measures an RMSP should take
  • The exact definition of a "significant incident" that triggers notification duties

Separately, penalty figures and MSP-population estimates are circulating in law-firm trackers and industry commentary, but these are not confirmed on GOV.UK or Parliament's own pages, so treat any specific numbers you see quoted elsewhere with appropriate caution until secondary legislation lands.

On timing (last checked 27 October 2026): the Bill has completed all Commons stages and Lords Committee Stage (held in Grand Committee, 1–7 September 2026). The current Lords version is HL Bill 62, as amended on Report. Lords Report Stage took place on 26 October 2026. Lords Third Reading is provisionally expected on 2 November 2026; future dates may change (official Bill page). Royal Assent would not be the same as commencement, and the Bill is not law in force today.

For smaller clients outside the RMSP category, our Small Business Cyber Starter Checklist is a printable place to start.

Secordit Intelligence products are operational intelligence and compliance readiness materials. They do not constitute legal advice and do not guarantee regulatory outcomes.

Last reviewed: 27 October 2026

Matthew Protheroe-Hill, Founder, Secordit Intelligence

Back to blog