Secordit Intelligence

What MSPs should prepare before Lords Committee Stage

31 August 2026 · Matthew Protheroe-Hill

Secordit Intelligence logo and the headline “PREPARE FOR COMMITTEE” on a dark panel fading into a photo of a black-and-white close-up of a meeting table.

Position checked at 31 August 2026

The Cyber Security and Resilience (Network and Information Systems) Bill has completed its Lords Second Reading. At the time of writing, the next step was Committee Stage, due to begin on 1 September. The Bill is still a Bill: it has not received Royal Assent, and the proposed MSP measures are not duties in force.

For MSPs, the useful question at this stage is not “Are we already regulated?” It is “Can we describe what we do, and what parts of the proposal are still unsettled?”

1. Which services look like managed services?

The Government’s proposed Relevant Managed Service Provider (RMSP) definition focuses on providing managed services in the UK, with micro and small enterprises excluded from this specific category subject to the Bill’s exceptions. The factsheet describes managed services that can include ongoing IT outsourcing, helpdesk or infrastructure management, and managed security services. Connection to or access to the customer’s network and information systems is a key feature of the proposal.

That makes service descriptions a useful preparation input: distinguish ongoing management and administration from one-off projects, resale, or support that does not involve ongoing management. This is a way to organise questions, not a Secordit scope decision.

2. What has not been settled?

The Bill sets out a framework, but additional technical and operational detail is expected through secondary legislation. The Government’s RMSP factsheet says further security and resilience requirements and thresholds for significant incidents are among the details to be introduced later. The measure is intended to be brought into force through secondary legislation after Royal Assent.

So an MSP should avoid treating a proposed control list, a headline size label, or a draft threshold as the final regulatory test. Keep a dated record of what comes from the Bill, what comes from policy factsheets, and what remains dependent on later regulations or guidance.

3. What is sensible to prepare?

  • Keep a clear inventory of ongoing managed services and the systems they rely on.
  • Record, at a general business level, where customer-system access is used to deliver those services.
  • Confirm that incident records, escalation routes and customer communications are documented.
  • Track the Bill’s progress and keep proposed duties separate from current NIS obligations.

These are proportionate housekeeping steps, not a declaration that the Bill applies to every MSP or that a new reporting clock has started.

If a small client asks where to begin, our Small Business Cyber Starter Checklist is a printable starting point.

What to watch next

Committee Stage is where the Lords examines the Bill in detail and may agree changes. Follow the official Bill text and amendments as they appear. The proposed RMSP framework could change during passage, and the eventual operational requirements will depend on further legislation.

For practical groundwork alongside this, the kits cover tasks such as answering supplier security questionnaires and preparing Cyber Essentials answers.

Sources: UK Parliament Bill stages; GOV.UK RMSP factsheet.

Secordit Intelligence products are operational intelligence and preparation materials. They do not constitute legal advice and do not guarantee regulatory outcomes. Buyers should verify current legal requirements against official sources and seek legal advice where required.