If your managed security provider has just sent a reassuring note about the Cyber Security and Resilience (NIS) Bill, read it twice. Introduced in the House of Commons on 12 November 2025 as Bill 329, this legislation would rewrite the NIS Regulations. The Explanatory Notes point to provisions on managed service providers, incident reporting and critical suppliers. None of that is law yet. That is precisely why the next few months matter for directors.
This analysis takes a buyer-side view. We work through three questions: whether your North West SME could fall inside the new scope, what your managed security service provider has committed to in writing, and who reports an incident plus what evidence you would need to produce. We also cover the contract clauses to request now, how to spot a reassuring answer that is not a substantive one, how to check the Bill yourself, and the three questions to put to your IT provider this quarter.
Why the NIS Regulations Are Being Rewritten in 2026
The NIS Regulations set cyber security and incident reporting duties for certain essential and digital service providers. The Cyber Security and Resilience (Network and Information Systems) Bill, Bill 329, was introduced in the House of Commons on 12 November 2025, so the rules are moving.
The Bill is still in progress and the reformed scope is not confirmed. That is exactly why the practical move for a director is contractual and diagnostic rather than legislative. See our guide to what the UK Cyber Security and Resilience Bill means for your managed IT provider. If you are reviewing who should carry those duties, our guide to cyber security companies in the UK covers what North West businesses should check before choosing a provider.
More North West SME directors are now asking their IT provider what reform means for their contract, their reporting duties and their evidence, rather than waiting for the final text.
Your job for the rest of this piece is threefold: work out whether your business is likely captured, check that your provider’s duties and incident reporting are named in writing, and know what evidence you would have to produce.
Use the Bill 329 Explanatory Notes as your primary reference. They are not endorsed by Parliament and do not form part of the Bill.
What the Cyber Security and Resilience Bill Sets Out So Far
The structure below comes from the Bill 329 Explanatory Notes, not the Bill itself. Those Notes are not endorsed by Parliament and do not form part of the Bill.
Two headings sit at the centre of the buyer conversation: Clause 9 on managed service providers and Clause 10 on the duties of managed service providers to manage risks. Both point at the outsourced IT and security functions many North West SMEs already rely on, which is why the questions in the cyber security managed services conversation have shifted from tools to contracts.
Clause 12 on critical suppliers raises a familiar shape for leaner firms: what happens when the business depends heavily on a single provider? Clauses 14, 15 and 16 on information from digital or managed service providers, incident reporting by regulated persons, and notification of incidents to customers, together describe the reporting chain a director would sit inside.
Treat all of this as headings, not duties. Clause contents must be verified against the full Bill before any specific obligation is treated as settled. Be wary of summaries that do not date themselves or cite their source.
With that caveat in place, the first question is scope.
Question 1: Could Your North West SME Fall Inside the New Scope?
The clause list raises the practical question: does any of it reach you? Ask your provider to set out, in writing, which sectors and organisation types the NIS Regulations cover today, and which parts of that picture the Bill proposes to change.
Push on thresholds. Is a size test proposed, based on headcount or turnover? Require the source and the date it was checked, not a general assurance that you are too small to matter.
Consider indirect capture. You may not be named in the Regulations and still be pulled in as a supplier to a larger, clearly in-scope customer whose contract demands equivalent security and reporting.
Provider dependence matters too. If critical supplier provisions apply, ask how your reliance on one provider is treated, and what happens to your service if that provider failed or was itself compromised. These are the same commitments you would look for in a strong IT support SLA, where response and escalation terms are defined rather than assumed.
Finally, request a short written scope assessment stating the reasoning, the assumptions and a review date. That gives you something concrete to show a board, a customer or an insurer.
Question 2: What Has Your Managed Security Service Provider Committed to in Writing?
Scope answered, the next question is contractual. The Explanatory Notes flag duties on managed service providers under Clauses 9 and 10, so ask your provider to name, contract by contract, what it has committed to do about managing risk, not what it does in general.
Then get specific. Which controls sit under the agreement: endpoint detection and response, threat hunting, patch and vulnerability management, backup and identity management. Who owns each one.
Ask who is accountable when a control fails, how the provider escalates to you, and whether that path is written into the service description or only described in a sales conversation. Ask how subcontractors and third party tools are governed, and whether you must be told when they change, since changed tooling can shift your own risk position.
Finally, ask for every answer to be recorded in the contract, a schedule or a signed service summary with a review date, not left in an email thread nobody can find later. If the commitments are only verbal, you cannot evidence them. Ask now, while the Bill is still in progress and answers can still be shaped.
Question 3: Who Reports the Incident, and What Evidence Would You Need to Produce?
Evidence is the part of incident reporting that most SMEs underestimate. Ask your provider, in writing, who notifies whom and within what time window, and insist on a clear distinction between your provider telling you about an incident and you telling a regulator, a customer or an insurer. Those are not the same duty.
The Explanatory Notes list Clause 16 on the notification of incidents to customers, though the clause text must be verified against the full Bill. Ask what arrives after an incident: a written timeline, an affected asset list, a root cause summary and remediation steps, delivered by when, and in what format.
Then turn the question inward. Which records would you have to produce yourself, covering system logs, change records, asset inventories, staff training records and previous incident reports? How long is each retained, in what format, and how quickly could you retrieve it? If the answer is vague, the benchmarks in this guide to managed IT support in Manchester are a useful reference point.
Ask whether a joint incident response runbook exists, who is named in it, when it was last tested, and whether any test started at a supplier rather than inside your own network. If an incident begins with a third party, how would you hear early enough to meet your own obligations?
These answers usually sit inside wider security support, such as EDR and threat hunting. The government’s factsheet on relevant managed service providers is a sound starting reference while the reform remains in progress.
The Contract Clauses and Paperwork to Ask For Now
Move those answers into a contract schedule, because a definition argued over during an incident costs far more than one agreed in advance.
Incident definitions and notification. Agree what counts as an incident, and separately what counts as significant or reportable, in wording both sides can apply under pressure. Fix a notification timescale, name a primary and an out-of-hours contact, and specify the format you will receive: written timeline, affected assets, root cause and remediation.
Information sharing. Confirm your right to share provider reports with a regulator, your insurer and your own customers, and the provider’s duty to cooperate.
Supply chain visibility. Require disclosure of subcontractors and critical suppliers, notification of material changes, and resilience evidence you can review before each renewal.
Evidence, exit and review. Secure audit rights, defined data return and exit terms, and a documented annual review of every clause above, so the agreement does not go stale while the Bill is in progress.
These are contract best practice rather than settled legal requirement, and the same clause-by-clause standard sits behind our practical buyer’s checklist for Liverpool IT support. Use it at your next review of your managed security service provider.
Spotting a Reassuring Answer That Is Not a Substantive One
With the clauses and definitions pinned into writing, the real test is the answers you get when you probe them.
Reassuring answers sound like this: “we are fully compliant”, “do not worry”, “we will handle it”, “nothing will change for you”. None names a clause, a control, an owner or a date.
A substantive answer does. It cites the clause or source, describes the control in place, states who owns it, gives a timescale, and admits the limits of what is known.
A good managed security service provider will say openly that the Cyber Security and Resilience Bill is in progress, separate what is confirmed from what is not, and date the answer. It will also discuss the paperwork you must hold, not only the technology it deploys, because incident reporting duties are usually met with records rather than tools.
Watch for two assumptions. One is that the current NIS Regulations will not change; the government’s own impact assessment confirms that not all sectors or services, such as retail, are in scope, so scope claims need checking against the amended text. The other is that a North West SME of your size will never be captured, when the Bill brings data centres and managed service providers into scope.
Treat an undated assurance as a prompt to check the source yourself.
How to Check the Bill Yourself Before You Rely on Anyone’s Summary
A substantive answer is only as good as the source behind it, so verify the Bill yourself rather than relying on any summary, this one included.
Read the source, then the stage. The Explanatory Notes for Bill 329 sit on publications.parliament.uk. Read them there directly, and confirm the Bill’s current parliamentary stage before you quote it to a customer, a board or an insurer. The Notes are not endorsed by Parliament and do not form part of the Bill.
Cross-check every summary against the clause list. If a claim matches no clause, or attaches a duty to a clause that deals with something else, flag it. Commentary stays commentary.
Date everything. Watch for official guidance as it is published, and note the publication date of every source you rely on, plus the date you checked it. Revisit your answers each quarter: a question that cannot be answered today may be answerable after the next stage of the Bill, and your position may move with it.
Ask how your provider tracks it. Does the answer come from a named person, with a date, or from a generic inbox?
Three Questions to Put to Your IT Provider This Quarter
Having checked the Bill yourself, the next step is to make your provider answer for it in writing. Send the three questions below and ask your managed security service provider for written responses: could we be in scope, what have you committed to in contract, and who reports the incident and with what evidence. Set a review date tied to the Bill’s progress. What matters now is a documented position you can update, not a prediction.
Where any answer is vague, move it into the contract or a signed schedule: notification timescales, named contacts, and the evidence you will receive. General assurances will not help you with a customer, a board or an insurer. Our guide to cyber insurance for UK businesses explains why that written record increasingly matters at renewal.
Keep your own records tidy too. Asset lists, logs, change records and training records are what turn an obligation into something you can actually evidence.
Thin answers are useful information. If your provider cannot name a clause, a control owner or a date, that tells you something about the relationship. Blowfish Technology has supported North West businesses with managed IT and cyber security since 2012, and can review your position against the current NIS Regulations while reform is still in progress.
Conclusion
The Cyber Security and Resilience Bill is still moving, but the questions it raises can be answered now. Check whether your North West SME falls inside the new scope, ask your provider what it has committed to in writing, and agree who reports an incident and with what evidence. Move vague assurances into contracts or signed schedules, and keep asset, log and training records tidy so you can evidence your position.
Next, send the three questions to your IT provider this quarter and set a review date tied to the Bill’s progress. Blowfish Technology has supported North West businesses with managed IT and cyber security since 2012 and can review your position against the current NIS Regulations while reform is still in progress. A documented position today beats a prediction you cannot defend.
Frequently Asked Questions
What is the Cyber Security and Resilience (NIS) Bill, and is it law yet?
The Cyber Security and Resilience (Network and Information Systems) Bill, Bill 329, was introduced in the House of Commons on 12 November 2025. It would rewrite the NIS Regulations, but it is still in progress and none of it is law yet. The reformed scope is not confirmed.
Could my North West SME fall inside the new scope?
You may not be named in the Regulations but could still be captured indirectly as a supplier to a larger, in-scope customer whose contract demands equivalent security and reporting. The post recommends asking your provider in writing which sectors and organisation types the NIS Regulations cover today, whether a size test (headcount or turnover) is proposed, and how reliance on a single provider is treated. It also suggests requesting a short written scope assessment with reasoning, assumptions and a review date.
What should my managed security service provider have committed to in writing?
Ask your provider to name, contract by contract, what it has committed to do about managing risk. Specify the controls covered, such as endpoint detection and response, threat hunting, patch and vulnerability management, backup and identity management, and who owns each one. You should also confirm who is accountable when a control fails, how escalation to you works, how subcontractors and third-party tools are governed, and that every answer is recorded in the contract, a schedule or a signed service summary with a review date.
Who reports an incident, and what evidence would I need to produce?
Ask your provider in writing who notifies whom and within what time window, and distinguish between the provider telling you about an incident and you telling a regulator, customer or insurer, since these are different duties. Ask for a written timeline, an affected asset list, a root cause summary and remediation steps. Also identify the records you would need to produce yourself, such as system logs, change records, asset inventories, staff training records and previous incident reports, along with their retention periods, formats and retrieval speed.
How can I tell if my provider's reassurance is substantive?
Reassuring answers such as "we are fully compliant", "do not worry" or "nothing will change for you" name no clause, control, owner or date. A substantive answer cites the clause or source, describes the control in place, states who owns it, gives a timescale and admits the limits of what is known. Treat any undated assurance as a prompt to check the source yourself, and verify the Bill directly, for example via the Bill 329 Explanatory Notes on publications.parliament.uk.
