The UK's Cyber Security and Resilience (Network and Information Systems) Bill has reached a significant milestone following the conclusion of House of Lords Report Stage on 26 October 2026, bringing it closer to becoming law.
Introduced to Parliament in November 2025, this landmark piece of legislation seeks to equip the UK to respond to fast-evolving cyber threats. It does this by expanding and strengthening the UK’s 2018 Network and Information Systems (NIS) Regulations, which currently apply to critical and essential services. Once passed into law, organisations such as Managed Service Providers (MSPs) and large data centres will be brought into scope, and regulated entities will be subject to stronger incident reporting requirements.
Perhaps most significantly, the legislation arms the Government with sweeping new powers to continually amend the strength and scope of regulations without further primary legislation. The Government argues this will effectively future-proof the UK’s cyber regime, ensuring ministers can respond quickly as threats change.
Since the Bill’s introduction, ISACA has worked with policymakers, drawing on the expertise of its members to advocate for legislation that strengthens cyber resilience, professional competence, effective governance and independent assurance.
With Report Stage concluded, ISACA's advocacy has helped secure important ministerial commitments, although further changes are still needed. As much of the detail will be determined through secondary legislation, this article explores the latest developments, what they mean for cyber professionals and where ISACA will continue to advocate for a robust and effective regulatory framework.
ISACA's engagement throughout Parliament
ISACA's advocacy on the UK's cyber regulatory framework predates the current Bill, having previously called for MSPs and large data centres to be brought within the scope of the NIS Regulations. Their inclusion in the Bill represents welcome progress on ISACA's longstanding recommendations.
Following the Bill's introduction, ISACA worked with its members and parliamentarians across parties to identify opportunities to strengthen the legislation in four priority areas: scope and supply chains; skills and competencies; accountability; and testing and assessment.
ISACA's research and recommendations were referenced by a cross-party group of MPs and peers, including Dame Chi Onwurah MP, then Chair of the Science, Innovation and Technology Committee.
Ahead of Lords Committee Stage, ISACA convened a roundtable with parliamentarians, regulators and industry representatives to discuss the Bill's practical implications, including the importance of proportionate regulation, professional skills, governance and assurance.
Several peers subsequently tabled amendments reflecting ISACA's recommendations, bringing the perspectives of cybersecurity professionals into parliamentary debate.
Ahead of Report Stage, ISACA worked with the Liberal Democrats on a further amendment (Amendment 81), tabled by Baroness Northover, proposing a framework for organisational cyber resilience and professional competence that explicitly named ISACA as a body to be consulted.
The amendment was not moved after the Minister gave commitments on professional competence, which are set out below.
Five key takeaways from Lords Report Stage
Report Stage saw the Government bring forward substantial amendments in response to criticism from peers and other stakeholders. More than as such there was over 100 amendments were agreed, alongside further ministerial commitments on matters to be addressed through secondary legislation. Positively, several of these changes and commitments reflect ISACA’s advocacy with parliamentarians.
1. Professional competence and workforce capacity are central to cyber resilience
Following ISACA's work with the Liberal Democrats on an amendment to strengthen requirements around professional competence, the Minister confirmed at Report Stage that forthcoming mandatory Security and Resilience Requirements (SRRs) would include proposals for skilled and accredited individuals to hold senior accountability for cyber resilience, alongside appropriate training and accreditation. The detail will be determined through the expected consultation in the next few months and secondary legislation.
Peers also agreed a non-government amendment that would require the Government to review the effectiveness of the NIS framework within 12 months of the Bill becoming law, and annually thereafter, including whether the UK has enough cybersecurity professionals to protect essential services. This non-government amendment remains subject to further parliamentary consideration.
ISACA’s 2026 State of Cyber research underlines why this matters: more than half (56%) of European cybersecurity professionals say their teams are understaffed, even as four in ten (38%) report facing more attacks than last year.
2. Board accountability must be supported by effective assurance
ISACA has consistently advocated for cyber resilience to be recognised as a responsibility extending beyond technical teams, requiring effective board oversight and independent assurance.
Although proposals to introduce additional explicit board-level duties into the Bill did not progress, the Minister has now confirmed that forthcoming SRRs would include requirements for boards to establish and oversee organisational security and resilience frameworks.
The Minister also indicated that organisations would be expected to maintain evidence demonstrating compliance, with the Cyber Assessment Framework recommended as a means of assessing security and resilience.
3. Supply-chain resilience and regulatory scope remain critical
ISACA has advocated for stronger supply-chain resilience, including greater recognition of risks beyond direct suppliers and ensuring that critical technology providers are appropriately covered by the legislation.
At Report Stage, peers agreed Government amendments strengthening powers to address national security risks associated with technology vendors. The Minister also confirmed plans to consult on identifying critical suppliers and proposed a mechanism to bring certain high-risk smaller digital and managed service providers within regulatory scope.
Separately, peers agreed a separate non-governemnt amendment, which would require the Government to establish a register of foreign powers posing cyber threats to critical network and information systems. This amendment remains subject to further parliamentary consideration.
4. Incident reporting must be proportionate and keep customers informed
Through engagement with its members, ISACA has emphasised the importance of proportionate incident-reporting requirements that avoid unnecessary burdens and duplication across regulators.
At Report Stage, peers agreed Government amendments refining reporting requirements to reduce unnecessary reporting of incidents based solely on their potential impact.
Further amendments strengthened requirements for certain digital service providers, managed service providers and data-centre operators to keep affected customers informed during significant incidents.
The Minister also committed to developing a voluntary near-miss reporting mechanism to support information sharing and learning from cyber incidents.
5. AI security is becoming an important part of cyber resilience
Report Stage also saw the Government introduce new provisions addressing emerging cybersecurity risks associated with artificial intelligence, particularly incidents involving the loss of control of AI agents.
Peers agreed enabling future regulations to introduce investigative and enforcement powers relating to such incidents.
The Minister also committed to bringing forward further requirements through secondary legislation, including measures to reduce AI-related risks, preserve information about incidents involving malfunctioning AI agents and notify affected organisations.
What comes next for ISACA’s community?
As the Bill moves closer to becoming law, attention will increasingly turn to its practical implementation.
For ISACA members, a key takeaway is the growing recognition that effective cyber resilience depends not only on stronger regulatory requirements, but also on the skills, professional competence and accountability of those responsible fr implementing them.
The Government's commitments on accreditation, training and board oversight reinforce the importance of qualified professionals and recognised certifications in helping organisations manage cyber risks and meet their regulatory responsibilities.
Much of the detail remains to be determined through secondary legislation, forthcoming SRRs and regulatory guidance. These will be particularly important in establishing how professional competence is demonstrated, which qualifications and accreditations are recognised, and how organisations evidence compliance.
ISACA will continue engaging with Government, parliamentarians and regulators throughout the remaining parliamentary stages and implementation, advocating for recognised professional standards, effective assurance and proportionate requirements.
