The Cyber Security and Resilience Bill: what it means for UK MSPs
For the first time, UK law is set to regulate managed service providers directly. Medium and large MSPs that manage customers' IT on an ongoing basis would have to register with a regulator, run proportionate security, and report significant incidents within 24 hours.
This page sets out what the Bill says today, who it would cover, and where your own email domain fits. It does not say the Bill requires DMARC, because it does not.
Not law yet.
The Cyber Security and Resilience (Network and Information Systems) Bill is sponsored by the Department for Science, Innovation and Technology and amends the Network and Information Systems Regulations 2018. It is the UK's counterpart to the EU's NIS2 directive, though it is a separate law with its own scope.
Stage
House of Lords, Report stage. The current text is HL Bill 49, as amended in Grand Committee and published on 7 September 2026. It has passed the Commons.
Royal Assent
Not yet received at 9 October 2026. The text can still change at Report and Third Reading in the Lords, and in any back-and-forth with the Commons.
Then secondary legislation
The government says the managed service provider measures will be brought into force through secondary legislation after Royal Assent. The detailed security requirements and incident thresholds are set there, not in the Bill.
Four tests for a "relevant managed service provider".
The Bill creates a new regulated category. The government's factsheet on relevant managed service providers and the Explanatory Notes describe it in roughly these terms. Most medium and large UK MSPs will recognise themselves.
What the definition leaves out
- remove_circleData centre services and public electronic communications networks or services, which are regulated separately.
- remove_circleSmall and micro providers, though a small provider can still be designated a critical supplier under separate provisions.
- remove_circleBodies under public authority oversight that earn less than half their income commercially.
Being out of scope yourself does not take you out of the conversation. Clients that are regulated under the existing NIS rules will increasingly ask their suppliers the same questions.
Register, secure, report, tell your customers.
The regulator for managed service providers would be the Information Commission, the body formerly known as the Information Commissioner's Office. As the Bill was introduced, the duties look like this. Amendments tabled in the Lords could still change the detail, including the incident-reporting wording.
Register
Register with the Information Commission within three months of the measures coming into force, with a UK representative if you are based overseas.
Manage risk proportionately
Identify and manage risks to the systems you rely on to deliver the managed service, with measures proportionate to the risk, and take steps to prevent and minimise the impact of incidents. Specific technical requirements follow in secondary legislation.
Report within 24 and 72 hours
An initial notification of a significant incident within 24 hours of becoming aware of it, and a full report within 72 hours: to the regulator, with a copy to the NCSC.
Tell affected customers
Notify customers you consider likely to have been affected by a reportable incident, so they can protect their own systems.
Thresholds for what counts as "significant" are left to secondary legislation. Treat the 24-hour clock as the planning assumption: it is short enough that you need to know about an incident from your own monitoring, not from a client's phone call.
The Bill does not name DMARC. Your clients' inboxes will still test it.
The government's factsheets on the Bill do not mention DMARC or any specific email control. Anyone telling you the Bill mandates it is ahead of the text.
What the Bill does ask for is security proportionate to the risk your service poses. For an MSP, the most trusted thing you own is your own domain: clients act on invoices, password-reset instructions and change requests that appear to come from it. An attacker who can send as your domain does not need to breach your tooling to reach every client at once.
That risk is not hypothetical across the UK channel. Our UK MSP DMARC Adoption Report measured 8,724 UK MSP domains in August 2026 and found that 52.5% of MSPs had not protected their own company domain, and 43.2% received no aggregate reports at all. Those figures describe MSPs' own domains, not their clients'.
There is a detection angle too. DMARC aggregate reports show who is sending as your domain, every day. They will not tell you everything, but they are one of the few inputs that surfaces an impersonation campaign against your clients before a client reports it, which is the situation a 24-hour notification clock punishes.
A short list for the next quarter
- check_circleDecide whether you are likely to be in scope, using the four tests above, and write the reasoning down.
- check_circlePut your own domains at DMARC enforcement, in order:
p=none, thenp=quarantine, thenp=reject. RFC 9989 removed the percentage tag, so each step applies to all mail. - check_circleMake sure somebody reads the aggregate reports for those domains every week, and that a spoofing spike reaches your incident process.
- check_circleDraft a customer-notification template now. Writing it at hour 20 of an incident is the expensive way.
- check_circleDiary the secondary legislation consultation. That is where the actual technical expectations will be set.
This page summarises a Bill that is still before Parliament. It is not legal advice, and the duties described may change before Royal Assent and in the regulations that follow. Check the current text on the UK Parliament bill page.
Start with your own domain, then your clients'.
The work is the same either way: publish a reporting record, build the sender inventory, move to enforcement one domain at a time. Doing it on your own domain first gives you the playbook and the evidence before a client or a regulator asks.
Transparent MSP pricing from just £1 per domain per month, with volume-based pricing where the per-domain price falls as you add domains. There is no free tier, only a free trial.
Related reading in the academy: NIS2 obligations for MSPs, incident reporting and DMARC aggregate reports, and DMARC aggregate reports explained.
The rest of the UK cluster.
By sector
Questions UK MSPs ask us.
Is the Cyber Security and Resilience Bill law yet? add
No. At 9 October 2026 the Bill was at Report stage in the House of Lords, with the current text published as HL Bill 49 on 7 September 2026, and it had not received Royal Assent.
Even after Royal Assent, the government says the managed service provider measures will be brought into force through secondary legislation. The detailed security requirements and incident thresholds will be set there, so the practical obligations are still some way off, but the direction is settled enough to plan for.
Would my MSP count as a relevant managed service provider? add
If you manage customers’ IT on an ongoing basis under contract, connect to their systems remotely or on site, and are not a micro or small enterprise, very probably yes. The government factsheet gives support and maintenance, monitoring and active administration as examples of ongoing management.
The size test follows the EU Commission Recommendation on micro, small and medium enterprises that the Bill refers to. Broadly, providers with 50 or more staff, or above both the €10m turnover and €10m balance-sheet ceilings, are in scope. Data centre services, public electronic communications services and some public bodies are excluded, and a small provider can still be designated a critical supplier separately.
Does the Bill require DMARC? add
No. The government’s factsheets on the Bill do not name DMARC or any specific email-authentication control, and specific technical measures are left to secondary legislation.
What the Bill does ask for is security proportionate to the risk your service poses, and the ability to report significant incidents within 24 hours. For an MSP, the domain clients trust most is your own, and DMARC at enforcement is the cheapest proportionate control against it being used to impersonate you. That is an argument from risk, not a legal requirement, and it should be presented that way.
Who would regulate MSPs, and what would they have to report? add
The Information Commission, the body formerly known as the Information Commissioner’s Office. In-scope providers would register with it within three months of the measures coming into force.
As the Bill was introduced, a significant incident would need an initial notification within 24 hours of becoming aware of it and a full report within 72 hours, sent to the regulator with a copy to the NCSC. Providers would also have to notify customers they consider likely to have been affected. Amendments in the Lords could still change this wording. The thresholds for “significant” are for secondary legislation.
How does this relate to NIS2? add
It is the UK’s own update to its network and information systems rules, amending the NIS Regulations 2018, and it brings managed service providers into scope in a way that echoes NIS2. It is a separate law with its own definitions and regulators, though.
If you also serve clients in the EU, NIS2 obligations apply to that work under each member state’s implementation. Our academy covers NIS2 obligations for MSPs separately.
What should we do before the regulations arrive? add
Decide whether you are likely to be in scope and record why. Put your own domains at DMARC enforcement and make sure somebody reads the aggregate reports every week, so impersonation of your domain reaches your incident process quickly. Draft a customer-notification template. And follow the secondary legislation consultation, which is where the technical expectations will actually be set.
This is a summary of a Bill still before Parliament, not legal advice.
Secure the domain your clients trust most: yours.
Start a free trial, point your own domain's aggregate reports at DMARC AI, and see every source sending as you inside 48 hours. Transparent MSP pricing from just £1 per domain per month, with volume-based pricing where the per-domain price falls as you add domains.