Loading story…
The proposed UK Cyber Security and Resilience Bill would expand ministerial powers to address national security risks from technology suppliers and dependencies in critical sectors. Section 43 would allow the Secretary of State to direct regulated organisations to restrict or stop using products and services, change how systems are managed, or remove or modify equipment. Such directions could impose significant migration costs and operational disruption. Although the proposal requires a reasonable period for compliance, it sets no fixed minimum transition period, creating uncertainty for organisations dependent on difficult-to-replace technology.
Readiness would require organisations to maintain supplier inventories, map critical dependencies, continuously monitor supplier risks and document procurement and risk-management decisions. Contractual exit provisions and tested contingency arrangements would help organisations respond if restrictions require rapid supplier replacement or infrastructure changes. Smaller suppliers could also face additional cybersecurity obligations and costs as regulated customers pass requirements down their supply chains. CISOs should treat supplier exit capability and service continuity as governance priorities while distinguishing these proposed powers from obligations already in force.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Further amendments to the UK's proposed Cyber Security and Resilience Bill were proposed to introduce more specific powers concerning potentially risky technology vendors. The measures would allow ministers to address national security risks arising from technology suppliers and dependencies in regulated sectors.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government has proposed amendments to its **Cyber Security and Resilience Bill** that would give ministers new powers to restrict, condition, phase out, or ban technology suppliers used by operators of essential and critical services on national security grounds. The measures would apply beyond telecoms to sectors including **energy, water, transport, healthcare, managed service providers, data centers, and digital infrastructure**, and are intended to reduce the risk of hostile-state-linked vendors being used for **spying, sabotage, or disruption**. Under the proposed **vendor-related direction** regime, the government could intervene when organizations seek to buy from suppliers judged to pose critical risks, require extra security controls, or order withdrawal of existing technology. The framework would also allow ministers to act without publicly naming the vendor and, in some cases, without directly notifying the supplier, while restricting recipients and consulted parties from disclosing the order. The package also includes cyber-safe procurement guidance, a voluntary referral process for uncertain buyers, public notice that a direction was issued, and annual reporting to Parliament ahead of House of Lords scrutiny.
Aug 25, 2026
The UK government has introduced the Cyber Security and Resilience (CSR) Bill to Parliament, representing a major update to national cybersecurity legislation. The bill expands the scope of regulated entities to include datacenters and managed service providers (MSPs), in addition to existing coverage of operators of essential services such as healthcare, energy, transport, water, and digital service providers. The legislation aims to ensure these sectors meet robust cybersecurity standards, with new rules also extending to organizations overseeing smart appliances like electric vehicle charging points and smart heating systems. The CSR Bill grants ministers emergency powers to intervene during major cyber incidents and imposes stricter compliance requirements, including mandatory reporting of significant cyber incidents within 24 hours. Non-compliant organizations face substantial penalties, including daily fines up to £100,000 or turnover-based penalties, marking a shift toward enforcement that scales with organizational impact. The bill is expected to receive Royal Assent in 2026 and is positioned as a key component of the UK’s strategy to strengthen national resilience and protect critical infrastructure from evolving cyber threats.
Nov 12, 2025
The UK government advanced its **Cyber Security and Resilience Bill** after publishing policy materials in 2024 and formally introducing the legislation to Parliament in November 2025, later adding an impact assessment, factsheets, supporting research, and notice that the Regulatory Policy Committee rated the assessment **fit for purpose**. The bill is part of a broader push to strengthen cyber resilience obligations as the government also signaled tougher online safety enforcement and wider expectations that critical services and digital platforms improve security governance. Government survey data published in 2026 showed why the pressure is increasing: **43% of UK businesses** and **28% of charities** reported a cyber breach or attack in the previous year, with **phishing** remaining the most common and disruptive threat. While ransomware among businesses fell to **1%**, the survey found repeat victimisation drove an estimated **5.19 million** cyber crimes against UK businesses, and more advanced controls such as **two-factor authentication**, formal incident response plans, VPN use, and supplier risk reviews remained uneven, especially among smaller organisations. Industry reporting said the findings are sharpening focus on resilience measures including **Cyber Essentials Plus**, phishing-resistant MFA, network segmentation, tested backups, dependency mapping, and board-level reporting on recovery and operational survivability.
Aug 24, 2026