What has happened
The Department for Science, Innovation and Technology (DSIT) has published factsheets on the Cyber Security and Resilience (Network and Information Systems) Bill, legislation that was introduced to Parliament on 12 November 2025. The department says the Bill is designed to protect the services the public relies on, deliver what it calls a “step change” in national security, and support greater economic stability.
The factsheets themselves do not set out detailed new duties or compliance deadlines. Instead, DSIT points to a wider collection of documents on the Parliament website, including the Bill’s Explanatory Notes, a Delegated Powers Memorandum and Impact Assessments, for anyone who wants to understand how the legislation would work in practice.
Why it matters for UK firms
Any UK business that falls within scope of existing network and information systems rules, which today cover operators of essential services and certain digital providers, will want to track this Bill as it moves through Parliament. Updates to the NIS framework typically affect sectors such as energy, transport, health, water, and digital infrastructure, along with their suppliers.
Because the published factsheets stop short of confirming exact obligations, timelines or enforcement powers, companies cannot yet act on specifics. What is clear is that the government regards this as a significant piece of cyber security legislation, framed around resilience of public-facing services and broader economic stability rather than a narrow technical update.
What the document actually says
In plain terms, the factsheets confirm three things: the Bill exists and has formally begun its passage through Parliament, DSIT has stated three top-line goals for it, and the detailed legal text and analysis sit in separate Parliamentary documents rather than in the factsheets. For UK compliance teams, that means the factsheets serve chiefly as a signpost rather than a rulebook.
Organisations that want to assess potential impact now have reason to go directly to the Explanatory Notes and Impact Assessments on the Parliament website, since these are the documents likely to contain the operational detail, such as which entities could be newly captured and what reporting or security requirements might follow.
What to watch next
DSIT has invited queries via a dedicated email address, cybersecurityandresiliencebill@dsit.gov.uk, suggesting the department expects questions from affected organisations as the Bill progresses. The next milestones to watch are further stages of Parliamentary scrutiny and any accompanying guidance from DSIT that spells out scope, timelines and enforcement for UK businesses and public bodies.