The Cyber Bill That Could Change Who Your Suppliers Are: What Owner/Directors Need to Know Now
The UK’s proposed Cyber Security and Resilience Bill puts IT suppliers under closer scrutiny. What it could mean for your business, and five questions to ask your IT provider.
Introduction
You can outsource your IT support, cloud hosting and software management. But you cannot outsource the consequences when something goes wrong. If your IT provider suffered a cyberattack tomorrow, could your team still access customer records, process orders or run payroll? And how quickly would someone tell you what had happened?
These are the business questions behind the UK’s proposed Cyber Security and Resilience Bill. The proposals would strengthen oversight of important digital services, bring qualifying managed service providers into scope, and allow regulators to designate certain suppliers as critical.
For owner/directors, the message is not that you must immediately replace your suppliers. It is that resilience deserves a place alongside price, service and convenience when choosing who your business depends on.
What Is the Cyber Security and Resilience Bill?
The Cyber Security and Resilience (Network and Information Systems) Bill would update the UK’s existing rules for protecting essential services and certain digital services against cyber disruption. Its proposed expansion includes qualifying managed service providers, the businesses many SMEs rely on to manage and support their IT systems.
At the time of writing, the Bill is progressing through the House of Lords. It is not yet a new set of legal requirements applying to every UK business, and its final wording and implementation arrangements remain subject to the legislative process. That distinction matters. Business owners should prepare sensibly without assuming that every proposal is already law.
Why Should Owner/Directors Pay Attention?
Your business does not need to fall directly within the Bill’s scope for the changes to matter.
Your IT provider could face new requirements
Managed service providers meeting the proposed definition would become subject to statutory cybersecurity obligations. Small and micro-enterprise providers are generally excluded from that particular category, although a separate critical supplier designation could apply where the relevant conditions are met.
This makes your next supplier review a useful opportunity to ask: “Do you expect these proposals to apply to your business, and what would that mean for the service you deliver to us?”
Your customers could ask more of you
Even if your company is not directly regulated, customers that are within scope may seek stronger security assurances through contracts and procurement checks. This is an indirect commercial effect, not evidence that every business supplying a regulated customer automatically becomes regulated itself.
Being able to explain your security arrangements and recovery plans could therefore help you demonstrate that you are a dependable supplier.
Some suppliers could be designated as critical
The Bill proposes powers to designate suppliers whose disruption could significantly affect the UK economy or the day-to-day functioning of society. This would involve specific tests and a formal process; simply supplying an important customer would not automatically make a business a critical supplier.
The wider business lesson is straightforward: the importance of a supplier is not always reflected in its size.
The Risk Is Bigger Than Your Own IT Systems
The government highlights the June 2024 attack on Synnovis, a pathology services supplier to the NHS, as an example of the consequences of supplier disruption. The incident affected multiple London hospitals and more than 11,000 appointments and operations.
For an SME, the circumstances may be different, but the question is the same: “What happens to us when a company we depend on cannot deliver?”
Consider the services your business needs every day:
- IT support and remote administration.
- Email, document storage and cloud applications.
- Accounting, payroll and payment processing.
- Customer management and order processing.
- Backup and recovery services.
Use this list as a starting point for identifying dependencies, not as a list of businesses automatically regulated by the Bill.
Five Questions to Ask Your IT Supplier
You do not need a technical audit to begin a useful conversation. Start with these five questions.
1. Who can access our systems?
Ask how administrator accounts and remote access are approved, protected and removed when no longer needed.
Request a clear explanation of who has access, why they need it and how that access is reviewed.
2. How do you protect your own business?
Ask for evidence of security controls and independent assessments.
Where a supplier provides a certificate or assessment report, check what it covers. Do not assume it applies to every service you purchase.
3. How quickly would you tell us about an incident?
Agree who would contact you, how they would make contact and what updates you would receive.
The Bill proposes an initial regulatory notification within 24 hours and a fuller report within 72 hours for qualifying incidents affecting organisations in scope. Those proposed regulatory deadlines are not a universal SME reporting rule and they should not be confused with your supplier’s contractual obligation to notify you.
4. How would we recover if you became unavailable?
Ask who would help restore essential services, how recovery arrangements have been tested and whether another provider could step in.
Include a direct question: “Could we access our data, backups and essential documentation without relying entirely on you?”
5. Which other suppliers do you depend on?
Ask your provider to explain the important cloud platforms, hosting companies and subcontractors behind your service.
The objective is not to investigate every company in the chain. It is to understand the dependencies most likely to interrupt your business.
A Practical Action Plan for This Month
Treat the following as a business-resilience exercise, not a legal compliance checklist.
| Step | What to do | What you should achieve |
|---|---|---|
| Identify | List your five most business-critical technology suppliers. | A clear view of which services you cannot easily operate without. |
| Question | Send each supplier the relevant questions above. | Written answers rather than informal reassurance. |
| Review | Check incident communication, recovery responsibilities and exit arrangements. | Clarity about who does what when something goes wrong. |
| Test | Discuss a scenario in which your main IT provider is unavailable. | An agreed first response and a list of gaps to address. |
| Assign | Give someone responsibility for following up. | Actions with owners and review dates. |
Start with the supplier whose failure would cause the greatest disruption, not necessarily the supplier with the largest invoice.
Does This Mean You Should Change Suppliers?
Not necessarily.
The Bill does not mean every SME must replace its IT provider. Proposed obligations depend on the relevant definitions and, for critical suppliers, a designation process. A supplier review should help you make an informed decision rather than trigger an automatic switch. Look for a provider that can explain its arrangements, provide relevant evidence, acknowledge weaknesses and agree a realistic improvement plan.
Where answers remain vague, record what is missing and decide whether the risk is acceptable. If you do consider changing providers, include continuity, data access and transition support in the decision, not just the new monthly price.
Conclusion
The Cyber Security and Resilience Bill is still progressing through Parliament, but it provides a timely reason to examine the businesses behind your essential technology services. Its proposed expansion to qualifying IT providers and critical suppliers makes supplier accountability an important part of the discussion.
For owner/directors, the most useful response is practical: identify your key dependencies, ask for evidence, clarify responsibilities and test what would happen if a supplier became unavailable. You may not need a different supplier. You may need a better understanding of the one you already have.
At your next management meeting, start with one question:
“Which supplier could stop us trading, and what would we do if it failed tomorrow?”
Until next month, stay secure.