The King’s Speech, which took place on 13th May 2026, set out the UK Government’s legislative programme and included the Cyber Security and Resilience Bill.
Overall, the speech had a strong security and resilience theme, with a Tackling State Threats Bill, National Security Bill, and Energy Independence Bill joining the Cyber Security and Resilience Bill on the legislative agenda.
The purpose of the Cyber Security and Resilience Bill is to strengthen the UK’s defences against cyber attacks affecting essential services, infrastructure, and the digital economy. The Government says the UK is increasingly targeted by cyber criminals and state actors, and that the bill will update the existing Network and Information Systems Regulations to reflect modern dependence on digital services and supply chains. The bill is expected to expand the regulatory perimeter, including by bringing managed service providers into scope; improve incident reporting so damaging attacks are captured more consistently; and strengthen information sharing between regulators, public authorities, and Government.
For organizations, the practical significance is likely to be greater scrutiny of cyber governance, supplier assurance, operational resilience, incident response arrangements, and board accountability for cyber-related disruption.
Resilience professionals should track the bill’s progress, any amendments, regulator guidance, and sector-specific implementation requirements.
Comments sent to Resilience Forward
Mark Molyneux, Field CTO Northern Europe, Commvault:
“News that cyber security legislation is being prioritised by Parliament is overdue, but welcome progress. In the two years since the Cyber Security and Resilience Bill was first announced in the 2024 King’s Speech, we have seen multiple cyber attacks strike some of the UK’s biggest organizations with disastrous results. Despite the potential impact that such attacks can have on the country – such as the halt to Jaguar Land Rover’s production, which is thought to have significantly contributed to the economy contracting by 1% – the UK hasn’t had an updated cyber security law since 2018. This puts us behind the EU when strong, clear, and enforced cyber security regulation is essential for economic growth and stability.
“While a lengthy compliance period is likely to follow the Bill coming into law, companies mustn’t become complacent in the meantime. Cyber resilience is a critical business issue, not just a tick-box compliance exercise. Every organization should be confident in its ability to withstand an attack, recover quickly and cleanly, and keep downtime to a minimum. The objectives of the Bill are unlikely to change significantly between now and it coming into force, so using the first iteration or addressing the best practices laid out in the NIS2 directive or DORA will help organizations, regardless of the industry they’re in, to build a stronger security posture and put businesses in good standing when regulation is finally in place.”
Jamie Akhtar, CEO and Co-Founder of CyberSmart:
“Today’s speech makes clear that the Government’s focus on cyber resilience has continued to intensify.
“Over the past 12 months, the UK has seen a marked shift toward treating cyber resilience as a core issue of national security, economic stability, and operational continuity. That shift has been reflected not only in the progression of the Cyber Security and Resilience Bill, but across wider Government activity, including announcements at CYBERUK, continued NCSC intervention, and growing concern around AI-enabled cyber threats.
“Today’s speech reinforces that direction. The proposed expansion of regulation to include managed service providers, data centres, and critical suppliers reflects increasing concern around systemic cyber risk and supply chain concentration. MSPs and technology providers increasingly underpin essential services across both the public and private sectors, often with highly privileged access to critical systems. Bringing them into scope recognises the reality that attacks against trusted suppliers can have cascading national impact.
“The wider context matters. At CYBERUK earlier this year, Government and industry leaders repeatedly stressed the importance of resilience, operational readiness and moving beyond point-in-time compliance. The NCSC has also continued to emphasise that baseline cyber hygiene remains one of the most effective defences against the majority of attacks, with schemes such as Cyber Essentials playing an important role in raising security standards across UK organizations, particularly SMEs and supply chains.
“At the same time, the threat landscape is evolving rapidly. In recent remarks, NCSC CEO Dr Richard Horne warned that frontier AI models are increasingly capable of supporting offensive cyber activity, lowering barriers for attackers and increasing the scale and speed at which vulnerabilities can be identified and exploited. The explicit references to AI cyber capability within today’s briefing notes show that these concerns are now shaping Government policy directly.
“The Bill’s proposed measures reflect those trends:
- Mandatory reporting of significant incidents within 24 hours,
- Broader regulatory powers,
- Tougher turnover-based penalties,
- Greater oversight of supply chain dependencies; and
- The ability for Government to adapt the regime through secondary legislation as threats evolve.
“For businesses, the impact is unlikely to stop with those directly regulated. Customers, insurers, procurement teams, and investors are all placing greater emphasis on continuous assurance and demonstrable operational resilience. The organizations best positioned for this shift will be those able to provide clear, ongoing evidence of their security posture, building on foundational measures such as Cyber Essentials while moving toward more continuous and measurable resilience practices.
“The key challenge now will be implementation. Raising resilience standards across the economy is necessary, but ensuring that obligations remain practical and proportionate – particularly for SMEs and suppliers deeper in the chain – will ultimately determine how effective the regime becomes in practice.”
