UK Unveils Cybersecurity Bill: Major Overhaul for Critical Infrastructure Operators Coming?

Given the rising number of high-profile cyber incidents resulting in significant losses and disruptions for UK businesses and infrastructure, the UK government on 12 November 2025 introduced the new Cyber Security and Resilience (Network and Information Systems) Bill (the Bill), which augments the existing Network and Information Systems Regulations (NISR) framework.

Below is an overview of the key proposals.

The Bill proposes to significantly extend the NISR’s scope to operators of essential services (OESs) and relevant digital service providers (RDSPs) in certain critical sectors ( e.g. , electricity, transport and water). The new increased scope would cover:

Regulators would be granted additional powers to designate certain suppliers of goods and services as “critical suppliers” if an incident affecting them could significantly impact the UK. These suppliers would have the right to appeal their designation to the First-Tier Tribunal.

The obligations for critical suppliers would be outlined in future regulations, but the Department for Science, Innovation and Technology has confirmed that they would not be more stringent than those for OESs or RDSPs.

2. Stricter Incident Notification Obligations

The Bill also proposes tightening the current incident reporting obligations:

3. Increased Enforcement Powers and Recovery of Costs

The Bill also proposes stricter financial penalties for noncompliance:

4. Increased Regulatory Powers

The UK government would have the power to issue “necessary and proportionate” directions in response to cybersecurity issues threatening national security ( e.g ., by imposing restrictions on the use of goods and services) and impose daily fines of £100,000 for noncompliance. Importantly, these “national security” directions can be issued to any organisation carrying on “essential activity” in the UK, not just OESs, RDSPs or MSPs.

The government would also be empowered to introduce further obligations on regulated entities by amending the NISR in the future.

Importantly, the Bill does not propose any rules around ransom payments, a topic which much debate following this year’s consultation on cyber regulation, but such rules could still be introduced in separate legislation.

The Bill’s expanded scope is not as broad as that of the EU’s NIS2 ( e.g. , the manufacturing and food sectors are not brought within scope), but the UK government has the power to add new sectors in the future by specifying new “essential services” and “regulated persons.”

These reforms remain at an early stage, as the Bill still needs to progress through both Houses of Parliament. If entered into law, it would mark a huge compliance shift for those entities newly brought in scope.

There is a clear expectation from the UK government that companies take (and are seen to take) cybersecurity seriously. Companies should therefore consider taking action now to improve their cybersecurity posture, including by:

Companies that are already subject to the EU NIS2 regime should consider how their EU compliance work can support compliance with the potential UK reforms.

This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.