CSRB-BRIDGE: What MSPs should prepare before Lords Committee Stage

Position checked at 31 August 2026

The Cyber Security and Resilience (Network and Information Systems) Bill has completed its Lords Second Reading. The next scheduled step is Committee Stage, due to begin on 1 September. The Bill is still a Bill: it has not received Royal Assent, and the proposed MSP measures are not duties in force.

For MSPs, the useful question this month is not “Are we already regulated?” It is “Can we describe what we do, and what parts of the proposal are still unsettled?”

1. Which services look like managed services?

The Government’s proposed Relevant Managed Service Provider (RMSP) definition focuses on providing managed services in the UK, with micro and small enterprises excluded from this specific category subject to the Bill’s exceptions. The factsheet describes managed services that can include ongoing IT outsourcing, helpdesk or infrastructure management, and managed security services. Connection to or access to the customer’s network and information systems is a key feature of the proposal.

That makes service descriptions a useful preparation input: distinguish ongoing management and administration from one-off projects, resale, or support that does not involve ongoing management. This is a way to organise questions, not a Secordit scope decision.

2. What has not been settled?

The Bill sets out a framework, but additional technical and operational detail is expected through secondary legislation. The Government’s RMSP factsheet says further security and resilience requirements and thresholds for significant incidents are among the details to be introduced later. The measure is intended to be brought into force through secondary legislation after Royal Assent.

So an MSP should avoid treating a proposed control list, a headline size label, or a draft threshold as the final regulatory test. Keep a dated record of what comes from the Bill, what comes from policy factsheets, and what remains dependent on later regulations or guidance.

3. What is sensible to prepare now?

• Keep a clear inventory of ongoing managed services and the systems they rely on.
• Record, at a general business level, where customer-system access is used to deliver those services.
• Confirm that incident records, escalation routes and customer communications are documented.
• Track the Bill’s progress and keep proposed duties separate from current NIS obligations.

These are proportionate housekeeping steps, not a declaration that the Bill applies to every MSP or that a new reporting clock has started.

What to watch next

Committee Stage is where the Lords examines the Bill in detail and may agree changes. Follow the official Bill text and amendments as they appear. The proposed RMSP framework could change during passage, and the eventual operational requirements will depend on further legislation.

For a concise, source-linked overview of the proposal and the main open questions, get the free MSP briefing. If you need a structured internal baseline, CSRB-BRIDGE is a self-serve readiness framework using Secordit methodology; it does not determine official scope or guarantee compliance.

Sources: UK Parliament Bill stages; GOV.UK RMSP factsheet.

Secordit Intelligence products are operational intelligence and compliance readiness materials. They do not constitute legal advice and do not guarantee regulatory outcomes. Buyers should verify current legal requirements against official sources and seek legal advice where required.