ICO welcomes Cyber Security and Resilience Bill and expanded regulatory powers
The Information Commissioner’s Office (ICO) has welcomed the Cyber Security and Resilience (Network and Information Systems) Bill, introduced to Parliament on 12 November 2025, as a significant step in strengthening the UK’s cyber defences, while calling for further clarity in secondary legislation. The ICO has said the Bill will expand its regulatory remit to include relevant managed service providers and critical suppliers, enhance its enforcement, information-gathering and cost-recovery powers, and support a shift from reactive to proactive, risk-based oversight of digital and managed service providers across the UK. It has highlighted the benefits of improved incident reporting, including a proposed 24-hour reporting window for significant cyber incidents, but has urged the government to provide clearer guidance on key concepts such as significant impact thresholds, security and resilience requirements, enforcement measures and the definition of critical suppliers. The ICO has also emphasised the need for adequate funding, coordination with other regulators and timely guidance to help organisations understand and comply with the new requirements as the legislation progresses through Parliament.