The UK’s Cyber Security and Resilience Bill signals a new era of accountability

By Andy French, Director at Object First

The UK’s Cyber Security and Resilience Bill reflects a fundamental shift in regulatory thinking. Cyber resilience is not being judged solely by how well organisations prevent attacks, but by how effectively they can maintain operations and recover after disruption.

For years, cybersecurity regulation has focused primarily on prevention, encouraging businesses to strengthen defences by managing vulnerabilities and reducing the likelihood of attacks succeeding. Those priorities still matter, but the Bill broadens the focus: organisations must also be able to keep operating and recover quickly.

This shows that policymakers are starting to see cyber incidents as part of normal business risk, not rare events. Ransomware attacks, outages and software supply-chain compromises affecting digital services have shown how quickly damage can spread.

Firms and their leaders are beginning to be judged by their ability to maintain critical services and restore normal operations following a breach. Modern economies rely on connected digital infrastructure, where a single incident can affect customers, suppliers, partners and public services well beyond the original target. The 2024 CrowdStrike outage, for example, demonstrated how a single technology failure could disrupt operations worldwide, reinforcing the importance of operational resilience alongside cyber defence. 

Minimising disruption has therefore become an economic imperative as much as a technical challenge.

The regulatory spotlight moves down the supply chain

In the past, regulation focused mainly on companies that directly deliver essential services. The updated framework recognises that many of those services depend on a wider network of technology providers and operational partners. Managed service providers, data centres, energy system operators and other supporting organisations are now being treated as part of the resilience picture, rather than third parties sitting outside it.

That matches how modern businesses operate. Few organisations operate alone. Supply chains, cloud services, outsourced operations and specialist providers often play a central role in delivering services that consumers and businesses use every day. Regulators are therefore putting more weight on operational dependencies. Security teams will need clearer visibility of which suppliers support important services, how those relationships affect business continuity and what supplier failures could mean for wider operations.

The Bill points to a broader move towards stronger supply-chain accountability. Suppliers that underpin essential services may be brought within scope if regulators believe their failure could cause wider economic or societal disruption. 

That approach mirrors developments elsewhere, including Europe’s NIS2 Directive, where resilience obligations extend beyond traditional critical infrastructure operators. For business leaders, this means resilience can no longer be judged only within the business itself. The continuity of suppliers, partners and service providers is becoming a core part of managing organisational risk.

Faster reporting will test operational readiness

The proposed reporting requirements add to this shift. The framework introduces faster incident reporting obligations, including initial notification within 24 hours and a more detailed report within 72 hours. These timelines should improve national visibility of emerging threats and vulnerabilities, but they also create real challenges for the people and teams dealing with incidents.

In the early stages of a cyberattack, information is often incomplete. Security teams may still be trying to understand the cause of the incident and the scale of disruption to the systems that have been affected. At the same time, leadership teams, customers, regulators and other stakeholders will be looking for updates and reassurance. Meeting these reporting requirements will take more than documented compliance procedures. 

Recovery will define resilience

Perhaps the clearest signal in the Bill is that recovery capability is becoming the defining measure of cyber resilience. Regulators now want evidence that organisations can recover systems and services under realistic conditions, rather than simply point to policies, governance frameworks and written procedures.

This is especially relevant for ransomware. Modern attacks rarely focus only on encrypting production systems. Attackers increasingly target backup environments and recovery infrastructure because they know that removing an organisation’s ability to restore data increases disruption and pressure to pay. When recovery systems are compromised, the damage goes far beyond the initial attack. Disruption lasts longer, customers are affected more directly, and regulatory scrutiny becomes more intense.

This is one reason why absolutely immutable backup storage and Zero Trust principles are receiving increased attention. Absolute Immutability ensures that backup data cannot be altered or deleted once written, even by the most privileged administrator or an attacker using stolen credentials. 

Combined with architectures designed to reduce operational complexity and minimise reliance on privileged access, it provides confidence that recovery data will remain available when it is needed most.

The Cyber Security and Resilience Bill reflects a broader shift in how cyber resilience is assessed. Success will no longer be measured solely by preventative controls or documented policies, but by an organisation’s proven ability to withstand disruption, restore critical services and execute recovery under pressure. Businesses and leaders that can do so will be best placed to meet regulatory expectations, protect customers and maintain trust.