Cyber Security and Resilience Bill (UK)

After leaving the European Union, the United Kingdom did not transpose the NIS2 directive and remained governed by the 2018 regulations derived from the first directive on network and information systems security. In July 2024 the government announced a bill to modernize them, whose logic follows NIS2 without copying it. It aims to extend the scope of regulated entities to managed IT service providers, whose compromises have shown they can reach hundreds of clients at once, and to certain critical suppliers, as well as data centers. It plans to strengthen incident reporting obligations, with shorter deadlines and a wider scope, including ransomware attacks, and to give sector regulators greater powers. In parallel, the government consulted in 2025 on a ransomware-specific regime, including a ban on payments by the public sector and critical infrastructure operators and prior notification of intended payments. For insurance, the reform matters both to insureds, whose security and reporting obligations expand, and to cyber insurers, whose ransom and regulatory cost covers will need to adjust to the new prohibitions.