Hundreds of companies are about to need governance functions that do not exist yet.
When the Bill takes effect, newly regulated companies will be required to demonstrate accountable ownership of cyber risk, meet statutory reporting deadlines, and hold evidence that withstands inspection.
We assess the risk, set out the remediation, and appoint the people who own it.
Make an enquiryTwo services, one objective
Regulatory readiness requires both an accurate understanding of the risk and the people accountable for reducing it. We provide each independently, or together as a sequenced programme.
-
1. Cyber audit and risk assessment
An independent assessment of an organisation's cyber risk position, benchmarked against a recognised framework, producing a scored risk register, a prioritised remediation plan, and the evidence required by regulators, auditors and insurers.
-
2. Leadership and programme hiring
Executive and senior appointments across cyber governance, risk, resilience and compliance. Whole functions built in sequence rather than filled one role at a time.
What the Bill requires
The Cyber Security and Resilience (Network and Information Systems) Bill extends the 2018 NIS Regulations to sectors that have operated outside cyber regulation entirely. The obligations are statutory, not advisory.
- Newly in scope
- Medium and large managed service providers, data centre operators, large load controllers, and critical suppliers designated by regulators.
- Territorial reach
- Applies to organisations offering services in the United Kingdom, wherever they are established.
- Incident reporting
- Initial notification to the regulator and the National Cyber Security Centre within 24 hours of first awareness. Full report within 72 hours. Affected customers to be informed as soon as practicable.
- Maximum penalty
- The higher of £17 million or 4 per cent of worldwide turnover for the most serious failures.
- Accountability
- The Secretary of State may direct in-scope entities to act where an incident presents a risk to national security. Responsibility sits at board level.
A 24 hour reporting clock is not a policy document. It requires a named accountable owner, a tested decision path, an established regulatory relationship, and an evidence trail that survives inspection.
Most organisations coming into scope hold none of these, and have no individual whose responsibility it is to establish them.
Why the timing matters
Royal Assent will be followed by an implementation period and by secondary legislation setting the technical detail. Obligations are expected to take effect approximately 12 to 18 months from now. Recruitment lead times for regulated leadership appointments run to three to six months, and the qualified candidate pool does not expand on demand.
- November 2025 Bill introduced to the House of Commons.
- January to June 2026 Second reading, committee stage, report stage and third reading.
- June 2026 Bill clears the Commons and enters the House of Lords.
- Next Royal Assent, followed by secondary legislation defining technical and reporting requirements.
- The window Organisations that establish capability before the requirements take effect will be compliant on the first day. Those that delay will compete for the same limited pool at the same moment, and at a premium.
Identify the risk, then remove it
An independent assessment carried out to the standard a Chief Risk Officer would apply, without the organisation first having to appoint one. We establish where the risk sits, quantify it, and set out what must change, in what order, and at what cost.
What the assessment produces
- A scored risk register, rating each risk by likelihood and impact
- A gap analysis against a recognised framework, being the NCSC Cyber Assessment Framework, ISO/IEC 27001 or the NIST Cyber Security Framework
- A prioritised remediation plan, sequenced by risk reduction achieved per unit of cost, with named owners and indicative budgets
- A third party and supply chain risk review, covering obligations inherited through contracts
- A tested incident notification path, measured against the statutory 24 and 72 hour deadlines
- A reporting pack for the board and the audit committee
- An evidence pack suitable for regulators, auditors and insurers
How the engagement runs
-
1. Assessment
Review of systems, controls, contracts, governance and reporting arrangements against the applicable framework and the statutory duties expected to apply.
-
2. Remediation plan
A sequenced plan setting out what to change, in what order, by whom and at what cost. Written to be actioned, not filed.
-
3. Implementation support
Oversight of delivery, including selection of tooling and suppliers, revision of policy and process, and validation that each control operates as intended.
-
4. Assurance and reporting
Re-testing, maintenance of the evidence trail, and reporting in the form the board, the regulator and the insurer each require.
The insurance position. Insurers increasingly require documented evidence of specific controls before offering cover or setting terms. A documented risk position, with control gaps closed and evidenced, strengthens an organisation's standing at renewal.
More importantly, it reduces the likelihood and the cost of the incidents that give rise to claims in the first place. A claim paid is still a business interrupted, a customer notified and a regulator informed.
Programme hiring, not single hires
An organisation cannot achieve compliance through a single appointment. It requires a function. Someone accountable, someone who runs the reporting clock, someone who holds the evidence, and someone who owns the supply chain. We build the whole structure, in sequence.
-
1. Map the obligation
Establish where the organisation sits in scope, what its regulator will expect, and which capabilities are genuinely absent rather than assumed to be present.
-
2. Design the function
Define the shape of the team before the search begins. Roles, reporting lines, and the order in which each appointment needs to land.
-
3. Build it in sequence
Accountable leadership first, then the operating layer beneath it. Each appointment enables the next rather than duplicating it.
Appointments we make
- Chief Information Security Officer
- Chief Risk Officer
- Head of Cyber Governance
- Head of Regulatory Compliance
- Head of Operational Resilience
- Director of Assurance and Evidence
- Incident Response and Reporting Lead
- Third Party and Supply Chain Risk Lead
- Data Protection Officer
- Non-Executive Director, cyber and risk
Coming into scope for the first time
-
Managed service providers
Medium and large providers of third party information technology services, facing registration, reporting duties and regulatory scrutiny for the first time.
-
Data centre operators
Operators of digital infrastructure treated as essential, with resilience and reporting obligations attached to that status.
-
Critical suppliers
Suppliers designated as essential to regulated organisations, inheriting obligations through contracts already in place.
-
Investors and boards
Owners assessing whether a portfolio company is capable of meeting its obligations, and what it currently lacks in order to do so.
Make an enquiry
If your organisation is likely to come into scope, the first useful discussion concerns what you will be required to evidence, and who is going to own it.
Alternatively, telephone 020 3591 5622, or 07874 198004.