Secordit Intelligence

Cyber Essentials vs the Cyber Security and Resilience Bill: Why Certification Alone Isn't Enough

22 October 2026 · Matthew Protheroe-Hill

Secordit Intelligence logo and the headline “CYBER ESSENTIALS VS CSRB” on a dark panel fading into a photo of hands typing on a laptop.

Here's the mistake: treating Cyber Essentials as the answer to the Cyber Security and Resilience Bill.

For many UK managed service providers, Cyber Essentials (CE) or Cyber Essentials Plus (CE+) has long been the default answer to "are we secure enough?" It's a well-understood scheme, it's often a client contractual requirement, and it's renewed each year. So when MSPs first hear about the Bill, an easy assumption follows: "we've got CE+, so we're probably fine."

In our view, that assumption is worth unpacking carefully. CE and the Bill are not competing standards. They operate at different levels, and the gap between them is where MSPs are most exposed.

Cyber insurance proposal forms also ask detailed questions about how you run your IT, such as MFA and backups. The Cyber Insurance Readiness Kit helps you gather the evidence behind each answer.

Where the Bill stands

Before comparing frameworks, it's worth being precise about the Bill's status, since a lot of commentary online overstates how settled things are. According to UK Parliament's own bill-stages page, the Cyber Security and Resilience Bill had its First Reading in the Commons on 12 November 2025. Second Reading followed on 6 January 2026, and Committee stage began 3 February 2026. The Bill was reintroduced in the Commons on 14 May 2026 as part of the carry-over from the 2024-26 session into 2026-27. Report stage and Third Reading followed, both on 16 June 2026, then First Reading in the Lords on 17 June 2026. It went through Lords Second Reading on 14 July 2026 and Lords Committee Stage in Grand Committee between 1 and 7 September 2026. As last checked on 21 October 2026, the current Lords version is HL Bill 49. (Updated 30 October 2026) Lords Report Stage took place on 26 October 2026 and the Bill was reprinted as HL Bill 62. Lords Third Reading is provisionally expected on 2 November 2026; future dates may change (Bill page on UK Parliament). The Bill is not law in force until Royal Assent and commencement.

What Cyber Essentials covers

Cyber Essentials and CE+ were designed to verify baseline technical hygiene, and they do that job well. The scheme focuses on five core technical controls: boundary firewalls, secure configuration, access control, malware protection, and patch management. CE+ adds independent technical verification on top of self-assessment, which is more rigorous than CE alone. The scope is still the same five areas.

That's valuable. CE and CE+ are a solid technical floor, and nothing about the Cyber Security and Resilience Bill changes that or makes them redundant. If anything, having CE/CE+ in place gives an MSP a head start. The underlying technical hygiene it verifies is a sensible foundation for the governance layer the Bill is adding.

What the Bill adds

The Bill works by amending and expanding the existing Network and Information Systems (NIS) Regulations 2018. It does not replace them outright. Its most significant change for MSPs is a new legal category: the Relevant Managed Service Provider (RMSP). That's defined as an entity providing ongoing management of a customer's IT systems under contract. It covers support, maintenance, monitoring and active administration, whether delivered on-premises or remotely. According to the GOV.UK "Relevant managed service providers" factsheet (last updated 30 June 2026), medium and large MSPs providing UK managed services fall into scope. Small and micro enterprises and certain public authority bodies are exempt. Data centre services, public electronic communications networks, and pure operational-technology management without IT management are excluded from the RMSP definition. Data centres instead get their own separate regulated category. GOV.UK publishes factsheets on the Bill.

CE stops at technical hygiene. The Bill works at a governance and resilience level of its own:

Regulator registration

In-scope RMSPs must register with the Information Commission (the regulator for this regime) and provide entity details. Overseas-based providers must appoint a UK representative. Once the relevant provisions commence, RMSPs get three months to register. The underlying security duties, though, apply from commencement, not from the point of registration. There's no grace period on the substance of the obligations.

Incident reporting on a strict clock

This is the area with the least overlap with CE. The GOV.UK incident-reporting factsheet describes a proposed two-stage reporting process. First comes an initial notification to the regulator and to the NCSC/CSIRT, within 24 hours of becoming aware of a significant incident. A fuller report follows within 72 hours. Affected customers must also be told "as soon as reasonably practicable" if they're likely to be adversely affected. CE says nothing about how, or how soon, you report an incident once one occurs. For MSPs, whose access spans multiple client environments, a single incident can trigger a cascade of separate client-notification obligations. A CE-focused security programme isn't built to handle that.

To plan your first steps after an incident, see our First Hour After a Breach kit.

Supply chain and vendor risk management

The Bill expects "appropriate and proportionate" risk-management measures and ongoing due diligence across supply chains and vendor relationships, beyond the MSP's own perimeter. CE's scope is largely confined to the assessed organisation's own environment. It doesn't assess how an MSP evaluates or monitors the tools and subcontractors it relies on.

If customers send you their own security questionnaires, our Supplier Security Questionnaire Answer Kit helps you answer them honestly and consistently.

Continuous monitoring and evidence trails

CE/CE+ is a point-in-time snapshot, renewed annually. In our view, the Bill's expectation is closer to continuous. That means security kept proportionate to risk, using state-of-the-art methods. It also means being able to demonstrate ongoing diligence rather than a single certificate.

Board-level accountability

The governance expectations implicit in the Bill push cyber risk beyond the IT function and into the boardroom. That's a cultural and organisational shift a technical scheme like CE was never designed to measure.

Some of the operational detail isn't settled yet. The exact thresholds for what counts as a "significant" incident are left to secondary legislation that has not yet been published. So are the precise size or turnover thresholds distinguishing in-scope RMSPs from exempt small and micro enterprises. Treat any numbers you see quoted for these thresholds as speculative.

Cyber Essentials and the Bill, side by side

  • Scope of assessment: CE/CE+: five technical controls (firewalls, configuration, access control, malware protection, patching). CSRB: governance, incident response, supply chain, and technical controls together.
  • Assessment cadence: CE/CE+: annual, point-in-time. CSRB: continuous and evidence-based, in our reading.
  • Incident handling: CE/CE+: not addressed. CSRB: 24-hour initial notification, 72-hour full report, plus client notification duties.
  • Supply chain oversight: CE/CE+: not addressed. CSRB: vendor due diligence and supply chain risk management expected.
  • Accountability level: CE/CE+: IT/technical function. CSRB: board-level accountability implied, in our reading.
  • Regulator relationship: CE/CE+: the scheme's assessing body, no ongoing regulator registration. CSRB: registration with the Information Commission required for in-scope RMSPs.

Neither framework is "better" than the other. They answer different questions. CE/CE+ answers "is our technical hygiene sound?" The Cyber Security and Resilience Bill answers "can we detect, report, and govern our way through an incident, and can we prove it?" An MSP needs both answers, and holding CE or CE+ does not mean the second question has already been answered.

Where this leaves MSPs

The secondary legislation defining exact thresholds hasn't been published. Royal Assent and commencement timing remain uncertain. So no MSP can yet claim to meet a regime whose fine details don't exist. What an MSP can do is work out, honestly, where its CE/CE+ coverage overlaps with the Bill's direction, and where the gaps are. The published factsheet sets that direction out.

For small clients who need a first step, point them to our Small Business Cyber Starter Checklist.

Secordit Intelligence products are operational intelligence and preparation materials. They do not constitute legal advice and do not guarantee regulatory outcomes.

Last reviewed: 21 October 2026

Matthew Protheroe-Hill, Founder, Secordit Intelligence