Loading story…
Governments in the US, UK, and EU are advancing major legislative and regulatory efforts to strengthen cybersecurity and resilience across critical sectors and software supply chains. The European Union’s Cyber Resilience Act (CRA) introduces requirements for software and connected product vendors to embed security from the design phase, manage vulnerabilities throughout the product lifecycle, and deliver rapid updates, with global implications for SaaS providers and technology companies. In the UK, the new Cyber Security and Resilience Bill aims to overhaul protections for critical national infrastructure, updating the NIS Regulations and addressing the growing threat from nation-state actors, as highlighted by recent disruptive attacks on healthcare and other essential services.
In the United States, Congress has reauthorized the Cybersecurity Information Sharing Act (CISA 2015) through early 2026, restoring liability protections for organizations sharing threat intelligence with the federal government and sector-specific communities. However, the Cybersecurity and Infrastructure Security Agency (CISA) faces significant staffing shortages and capability gaps, prompting calls for increased funding and new strategies to address escalating cyber threats. Collectively, these legislative and regulatory actions reflect a global trend toward more robust, proactive, and coordinated approaches to cyber resilience and critical infrastructure protection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The UK government introduced a new Cyber Security and Resilience Bill to strengthen protections for critical national infrastructure, require rapid incident reporting, and impose stricter security obligations on suppliers and service providers.
A leaked memo from acting director Madhu Gottumukkala said CISA had a 40% vacancy rate in key mission areas, undermining its ability to support national security priorities.
The U.S. Congress reauthorized the Cybersecurity Information Sharing Act of 2015 on a short-term basis, restoring liability protections for cyber threat data sharing through January 30, 2026.
A high-profile cyberattack on Synnovis in 2024 was cited as a recent example of the threat facing UK critical national infrastructure and a driver for stronger regulation.
The UK established the Network and Information Systems Regulations 2018 as the baseline cyber regulatory framework later targeted for update by new resilience legislation.
The U.S. enacted the Cybersecurity Information Sharing Act of 2015, establishing liability protections for organizations that share cyber threat information with the government and ISAO/ISAC communities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityboulevard.com
Open sourceblog.knowbe4.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lawmakers in both the United States and the United Kingdom are advancing significant legislative measures aimed at bolstering cybersecurity protections for critical infrastructure and regulatory agencies. In the US, a bipartisan bill known as the SEC Data Protection Act of 2025 has been reintroduced to require the Securities and Exchange Commission (SEC) to modernize its cybersecurity protocols, implement uniform data protection policies, and align with federal and NIST best practices. The bill is a response to increasing cyberattacks on government agencies and concerns over outdated security frameworks, with the goal of ensuring the SEC can effectively prevent, detect, and respond to cyber threats while maintaining public trust in the financial system. Meanwhile, the UK government has introduced the Cyber Security and Resilience Bill to Parliament, marking a fundamental shift in the country's approach to protecting critical infrastructure. The bill addresses gaps exposed by recent high-profile breaches and brings managed service providers under regulatory oversight for the first time. It introduces eight major changes to enhance digital defenses and resilience, reflecting the evolving threat landscape and the need for updated regulations beyond the existing NIS framework. Both legislative efforts underscore a growing recognition of the need for robust, modern cybersecurity standards to safeguard sensitive information and essential services against increasingly sophisticated cyber threats.
Jun 29, 2026
The UK government has introduced the Cyber Security and Resilience (CSR) Bill to Parliament, representing a major update to national cybersecurity legislation. The bill expands the scope of regulated entities to include datacenters and managed service providers (MSPs), in addition to existing coverage of operators of essential services such as healthcare, energy, transport, water, and digital service providers. The legislation aims to ensure these sectors meet robust cybersecurity standards, with new rules also extending to organizations overseeing smart appliances like electric vehicle charging points and smart heating systems. The CSR Bill grants ministers emergency powers to intervene during major cyber incidents and imposes stricter compliance requirements, including mandatory reporting of significant cyber incidents within 24 hours. Non-compliant organizations face substantial penalties, including daily fines up to £100,000 or turnover-based penalties, marking a shift toward enforcement that scales with organizational impact. The bill is expected to receive Royal Assent in 2026 and is positioned as a key component of the UK’s strategy to strengthen national resilience and protect critical infrastructure from evolving cyber threats.
Jun 30, 2026
The UK government advanced its **Cyber Security and Resilience Bill** after publishing policy materials in 2024 and formally introducing the legislation to Parliament in November 2025, later adding an impact assessment, factsheets, supporting research, and notice that the Regulatory Policy Committee rated the assessment **fit for purpose**. The bill is part of a broader push to strengthen cyber resilience obligations as the government also signaled tougher online safety enforcement and wider expectations that critical services and digital platforms improve security governance. Government survey data published in 2026 showed why the pressure is increasing: **43% of UK businesses** and **28% of charities** reported a cyber breach or attack in the previous year, with **phishing** remaining the most common and disruptive threat. While ransomware among businesses fell to **1%**, the survey found repeat victimisation drove an estimated **5.19 million** cyber crimes against UK businesses, and more advanced controls such as **two-factor authentication**, formal incident response plans, VPN use, and supplier risk reviews remained uneven, especially among smaller organisations. Industry reporting said the findings are sharpening focus on resilience measures including **Cyber Essentials Plus**, phishing-resistant MFA, network segmentation, tested backups, dependency mapping, and board-level reporting on recovery and operational survivability.
Jul 21, 2026