Cyber Security and Resilience Bill: what it means for UK hosting customers and MSPs

A plain-English summary for UK organisations that buy hosting or managed IT services, and for MSPs that resell them. Position as of 30.09.2026, checked against the UK Parliament bill tracker.

Short answer

1The Cyber Security and Resilience (Network and Information Systems) Bill is a government bill that amends the Network and Information Systems Regulations 2018 (NIS).
2As of 30.09.2026 it is not law: it started in the Commons, cleared its Commons stages and is in the House of Lords, with report stage sitting scheduled for 26 October 2026.
3It brings relevant managed service providers (MSPs) into scope, with the Information Commissioner's Office (ICO) saying it would regulate them, and tightens incident reporting to a 24-hour window.
4Final wording and start dates may still change, so plan on the direction of travel rather than on clause-level detail.
5If you buy hosting or managed services, the practical job now is to know who runs what for you, what logs and backups exist, and who would report an incident.

Where the Bill stands (as of 30.09.2026)

The Bill is sponsored by the Department for Science, Innovation and Technology. The ICO's statement records that it was introduced to Parliament on 12 November 2025. The UK Parliament tracker lists it as bill 4035 (HL Bill 32 of 2026–27), currently in the House of Lords, with a report stage sitting scheduled for 26 October 2026. It is not an Act.

Read the official record on the UK Parliament bill page. Until Royal Assent and commencement regulations, nothing in it binds any supplier or customer.

What it is aiming at: MSPs, data centres and reporting

The long title describes provision amending the NIS Regulations 2018 about the security and resilience of network and information systems used in essential activities. Three themes matter to hosting buyers.

Managed service providers. The ICO calls extending its scope to regulate relevant managed service providers (RMSPs) “a natural progression”. If you outsource IT operations, your supplier may become regulated, and you may be asked more questions.
Data centres. A law-firm briefing (Travers Smith) reports that the Bill brings data centres into scope as essential services, with Ofcom as operational regulator and size thresholds to be set in secondary legislation. Treat this as a secondary-source summary, not as the text of the Bill.
Incident reporting. The ICO describes enhanced duties to notify regulators of incidents likely to have significant impact in the UK within a narrower window of 24 hours.

Practical examples

A UK agency running client sites on a managed VPS. It is the party clients deal with, so it should be able to show who has admin access and where logs go.
A small MSP reselling hosting. It should check whether it could fall inside the definition of a relevant managed service provider once the final text is settled.
A company with its own application on a dedicated server. The duty to understand its own systems does not move to the server vendor.

Common mistakes

Treating a Bill as if it were in force. It can change in the Lords and its commencement depends on later regulations.
Assuming the hosting provider carries your duties. If you are an operator of an essential service, the duties are yours.
Having no central logs, so a 24-hour notice to a regulator would be guesswork.
Never testing a restore from backup.
Not knowing which suppliers have administrative access to your systems.

How 4hosting helps

4hosting is run from Romania, with a datacentre in the EU, in Frankfurt, not in the UK. Its CyberSecurity services cover security audits and pentesting, WAF and DDoS protection, SIEM and incident response (centralised logs, detection, response plan, post-incident report) and hardening with alignment to GDPR and ISO 27001. Each subscription includes monthly DevOps, CyberSecurity and Programming hours, requested from the client panel, and work beyond the quota is billed separately.

4hosting does not hold NIS2, ISO 27001, Cyber Essentials or SOC 2 certification, does not certify your compliance and cannot sign it off for you. It does offer a data processing agreement under Article 28 GDPR and SCCs for transfers. The Bill may apply to an EU-based provider in some form; that is not settled. Until it is, your safest step is to document your own controls.

FAQ

Is the Cyber Security and Resilience Bill already in force?

No. As of 30.09.2026 the Bill is before the House of Lords, with report stage sitting scheduled for 26 October 2026 according to the UK Parliament bill tracker. Timing of Royal Assent and commencement is uncertain.

Does the Bill apply to 4hosting?

It may. 4hosting is an EU-based provider with a datacentre in Frankfurt, none in the UK. Whether and how the Bill reaches a non-UK provider depends on the final text and on how services are delivered into the UK, and we have not concluded that it does or does not apply. We will not claim compliance with a law that has not been enacted.

Can 4hosting certify that my setup meets the Bill?

No. 4hosting is not a compliance certifier and holds no NIS2, ISO 27001, Cyber Essentials or SOC 2 certification. We describe our controls as aligned with ISO 27001, and we provide technical services and documentation that support your own assessment.