Cyber Security and Resilience Bill
Cyber Security and Resilience Bill
Last refreshed: 20 May 2026
Will the 24-hour notification clock be law before the next Trellix-scale disclosure gap occurs?
Timeline for Cyber Security and Resilience Bill
Mentioned in: ICO fines South Staffs Water £963,900
Cybersecurity: Threats and DefencesMentioned in: RansomHouse posts Trellix internal screenshots as extortion leverage
Cybersecurity: Threats and Defences- What does the UK Cyber Security and Resilience Bill require companies to do?
- The Bill proposes a 24-hour initial-notification requirement for reportable cyber incidents and extends mandatory cyber-security obligations from the NIS Regulations 2018 to more sectors, including managed service providers and supply-chain entities.
- When does the UK Cyber Security and Resilience Bill become law?
- The Bill was at Commons Report Stage from 2 March 2026 and had not received Royal Assent as of May 2026. Timeline to enactment depends on parliamentary schedule.
- Why does the Trellix breach matter for the UK's new cyber law?
- Trellix took 21 days to disclose a breach that had occurred on 17 April 2026. The Cyber Security and Resilience Bill's 24-hour notification clause is designed to prevent exactly that gap. The case gives Parliament a current-quarter worked example of the disclosure-tempo problem the Bill targets.
- Does the UK already have cyber laws that apply to water companies?
- Yes. The ICO fined South Staffordshire Water £963,900 in May 2026 under the existing Data Protection Act 2018 and UK GDPR Article 32. The CS&R Bill will add further obligations, but current statute already provides enforceable baseline security requirements for CNI operators.Source: ICO
Background
The Cyber Security and Resilience Bill is the UK Government's proposed legislation to update and extend the Network and Information Systems (NIS) Regulations 2018, broadening mandatory cyber-incident reporting and security obligations to cover a wider range of critical national infrastructure sectors, managed service providers, and digital supply-chain entities. The Bill's headline measure is a 24-hour initial-notification requirement for reportable cyber incidents, intended to close the gap between breach discovery and public or regulator awareness. The Bill was at Commons Report Stage from 2 March 2026 at the time of writing and has not yet received Royal Assent.
The Trellix breach provides Parliament with a direct current-quarter example of what the 24-hour notification clause targets. Trellix disclosed a 17 April 2026 intrusion on 8 May 2026, a 21-day self-disclosure gap, and RansomHouse subsequently posted internal screenshots on approximately 11 May, a further 24 days after initial access. The total gap from initial access to public extortion pressure was 45 days, against the Bill's proposed 24-hour initial-notification clock. The South Staffordshire Water case compounds the picture: a 2022 ransomware breach ran undetected for 20 months before the ICO enforcement action on 12 May 2026.
A critical feature of the Bill's regulatory context is that the ICO is already applying enforceable cyber-security obligations under the Data Protection Act 2018 and UK GDPR Article 32 against the very sectors (water utilities, critical suppliers) the CS&R Bill targets, without waiting for Royal Assent. NCSC guidance now carries de facto enforceable weight via the ICO's interpretation of existing statutes, making the CS&R Bill's statutory regime an increment rather than a transformation of the live regulatory baseline.