Information Commissioner publishes response to Cyber Security and Resilience (Network and Information Systems) Bill

The Information Commissioner’s Office (ICO) has published a formal response to the Cyber Security and Resilience (Network and Information Systems) Bill, which was introduced to Parliament on 12 November 2025, signalling broad support for the proposed reforms while highlighting areas that will require further clarity.

Key Takeaways

Strengthening the UK’s cyber defences

The Information Commissioner views the Bill as an important step in strengthening the UK’s cyber security framework. It reflects the growing complexity of digital ecosystems and the increasing reliance on interconnected service providers. In particular, the Bill is seen as modernising the regulatory approach to better address contemporary cyber risks.

Expansion of the ICO’s regulatory role

A key feature of the Bill is the expansion of the Information Commissioner’s Office (ICO) remit. If enacted, the ICO would regulate not only digital service providers currently caught by the Network and Information Systems Regulations 2018, but also managed service providers, and critical suppliers within digital supply chains.

This change recognises the role these entities play in maintaining cyber resilience and the potential systemic impact of failures within supply chains.

Shift to a proactive, risk‑based approach

The Bill would mark a shift away from the ICO’s traditionally reactive role towards a more proactive, risk‑based oversight approach. This would be supported by enhanced regulatory powers, including:

• Broader information‑gathering powers, allowing the ICO to require data from regulated entities and third parties
• Improved information‑sharing mechanisms with other regulators and public authorities, subject to appropriate safeguards
• New enforcement tools, including penalties for registration failures and expanded cost‑recovery powers

Together, these measures are intended to allow earlier intervention and more effective supervision of cyber risks.

Need for Secondary Legislation and Guidance

While supportive of the Bill’s objectives, the ICO notes that many critical details remain to be set out in secondary legislation. This includes:

• Thresholds for what constitutes a “significant impact” in incident reporting
• Specific cyber security requirements
• Criteria for identifying critical suppliers

The ICO emphasises that clear and timely guidance will be essential to help organisations understand and comply with the new regime.