Secordit Intelligence

After Lords Committee Stage: What MSPs should know about the CSRB

30 September 2026 · Matthew Protheroe-Hill

Secordit Intelligence logo and the headline “AFTER COMMITTEE STAGE” on a dark panel fading into a photo of an empty conference room behind glass.

Position checked at 30 September 2026

The House of Lords Grand Committee completed its detailed examination of the Cyber Security and Resilience (Network and Information Systems) Bill on 7 September. At that date, Parliament’s Bill page listed HL Bill 49, as amended in Grand Committee, dated 7 September, and Lords Report Stage was scheduled for 26 October. (Updated 30 October 2026: the Bill page lists HL Bill 62, as amended on Report, dated 26 October 2026, as the current version of the Bill.)

The Bill is still before Parliament. It has not received Royal Assent, and the proposed new Relevant Managed Service Provider (RMSP) regime is not in force.

What did Committee Stage mean for MSPs?

Committee Stage is a line-by-line examination where members can consider and agree amendments. The practical point for an MSP is that the text has moved on from the version brought from the Commons. If you are tracking the proposal, use the latest official Bill version rather than an old PDF or a third-party summary.

That does not mean the committee has answered every operational question. The Government’s RMSP factsheet says the proposed measure would be brought into force through secondary legislation following Royal Assent. Additional security and resilience requirements and thresholds for significant incidents are among the details expected through later regulations.

Three things to keep separate

  1. Proposed category: the Bill describes an RMSP framework for providers of managed services in the UK, with micro and small enterprises excluded from this specific category subject to statutory exceptions. A provider’s service model and access to customer systems matter; “MSP” as a label alone is not a complete scope test.
  2. Proposed duties: the policy model includes registration, proportionate security measures and reporting of qualifying significant incidents. These are not new duties in force under this Bill as at 30 September.
  3. Implementation detail: commencement and operational requirements depend on further legislation and regulations. Reporting thresholds and detailed requirements should not be guessed from draft wording.

A useful monthly check

Record the date and version of the official text you reviewed. Keep a short list of questions that affect your business: which ongoing services involve management of customer systems; what systems support those services; who owns incident records and escalation; and which details are still awaiting regulations or guidance.

This creates a traceable starting point without treating a proposed regime as an immediate compliance deadline. It also makes it easier to update your internal view when the Bill or official materials change.

If your own business needs a simple place to begin, our Small Business Cyber Starter Checklist covers six topics, one at a time.

What to watch next

At 30 September, Report Stage was scheduled for 26 October. (As at 30 October 2026: Lords Report Stage took place on 26 October, and Parliament’s Bill page lists HL Bill 62, as amended on Report, as the current text. The Bill stages page lists Lords Third Reading for 2 November 2026 and notes that future dates may be provisional.) Check the amended text to see what changed. Passing a stage in the Lords does not by itself bring the proposed MSP duties into force.

Sources: UK Parliament Bill page and current text; Bill stages; GOV.UK RMSP factsheet.

Secordit Intelligence products are operational intelligence and preparation materials. They do not constitute legal advice and do not guarantee regulatory outcomes. Buyers should verify current legal requirements against official sources and seek legal advice where required.