Lords Report Stage: 5 CSRB questions for UK MSPs

Position checked at 21 October 2026

The Cyber Security and Resilience (Network and Information Systems) Bill remains before Parliament. Lords Report Stage is scheduled for Monday 26 October, and the current published text is HL Bill 49 as amended in Grand Committee on 7 September. This is a scheduled parliamentary stage, not an enacted law or a new compliance deadline.

For MSPs, Report Stage is worth following because the Bill can still be debated and changed. It is also a good moment to separate the questions Parliament may address from the operational details that are expected later.

Five questions to watch

1. Does the proposed RMSP definition change? The framework is directed at providers delivering managed services in the UK, with micro and small enterprises excluded from this category subject to statutory exceptions. Service type, ongoing management and access to customer systems are relevant to the proposal. Do not treat the everyday label “MSP” as a complete legal test.
2. Are any amendments made to the scope or exceptions? Follow the amendments tabled and the text that results from the debate. Do not assume an amendment is accepted just because it has been proposed.
3. What remains for secondary legislation? The Government says further security and resilience requirements and thresholds for significant incidents will be set out in secondary legislation. Those details are important to practical preparation.
4. When would the MSP provisions start? Royal Assent and commencement are separate steps. The RMSP measure is expected to be brought into force through secondary legislation after Royal Assent, with time for implementation. A Report Stage result alone would not start the proposed duties.
5. What will the Information Commission and guidance say? The proposed RMSP regime identifies the Information Commission as regulator, but detailed requirements and reporting thresholds still need to be made operational. Track official publications and commencement instruments as they appear.

What an MSP can do now

Keep a dated record of the current Bill version you reviewed. Map ongoing managed services at a general business level, the systems on which their delivery depends, and the internal owners of incident records and escalation. This provides an organised baseline while avoiding premature claims that a proposed duty applies or that the Bill has settled every detail.

The proposed incident-reporting model includes an initial notification within 24 hours and a fuller report within 72 hours for qualifying significant incidents. These are proposed reporting periods, not new universal duties in force today; the thresholds and implementation depend on further legislation.

After Report Stage, check Parliament’s updated stages page and the latest text. If the Bill changes, compare the actual wording and record what is still dependent on regulations rather than relying on headlines alone.

For a clear, source-linked summary of the Bill and its open questions, get the free MSP briefing. If you want a structured internal readiness baseline, CSRB-BRIDGE is self-serve and uses Secordit methodology; it is not an official scope decision or compliance guarantee.

Sources: UK Parliament Bill stages; current Bill text; GOV.UK RMSP factsheet; GOV.UK incident reporting factsheet.

Secordit Intelligence products are operational intelligence and compliance readiness materials. They do not constitute legal advice and do not guarantee regulatory outcomes. Buyers should verify current legal requirements against official sources and seek legal advice where required.