UK NIS Regulations 2018 & Cyber Security and Resilience (NIS) Bill
Status: NIS Regulations 2018 in force; CS&R Bill at Lords third reading (scheduled 2 Nov 2026)
The UK retains the NIS Regulations 2018 (operators of essential services incl. energy, transport, drinking water; relevant digital service providers). The Cyber Security and Resilience (Network and Information Systems) Bill amends the 2018 regime: brings additional sectors in scope, updates incident reporting duties and gives government powers to instruct organisations for national security. Lords report stage completed 26 Oct 2026 with two government defeats (NIS review within 12 months; register of hostile state actors). It must return to the Commons for consideration of Lords amendments before Royal Assent.
Who it applies to
- Operators of essential services (energy, transport, drinking water, health, digital infrastructure) and relevant digital service providers
- Bill would add further in-scope entities (e.g. managed service providers, designated critical suppliers) — details subject to final text
Why it matters for OT
Energy and water OES in the UK are supervised against NCSC's Cyber Assessment Framework (CAF); expect updated reporting and supply-chain duties.
Controls affected & IEC 62443 mapping
| Requirement | Indicative IEC 62443 reference |
|---|---|
| NCSC Cyber Assessment Framework objectives A–D (managing risk, protecting, detecting, minimising impact) | IEC 62443-2-1 (programme), 62443-3-3 (protect/detect SRs) |
| Incident reporting (updated timelines under Bill — final text pending) | IEC 62443-2-1 incident management |
IEC 62443 mappings are editorial and indicative.
Recent changes
Lords report stage complete
Peers agreed amendments requiring a review of the NIS regime within 12 months and a register of state actors; a frontier-AI incident reporting amendment was defeated. Third reading 2 Nov 2026.
Sources
- legislation.gov.uk – NIS Regulations 2018 (SI 2018/506) legislation.gov.uk
- UK Parliament – Cyber Security and Resilience (NIS) Bill bills.parliament.uk
- UK Parliament news – Lords report stage (27 Oct 2026) parliament.uk
- opengovt.uk bill passage summary (secondary) opengovt.uk
Monitored for changes: bills.parliament.uk, bills.parliament.uk. Data file: data/regulations/uk-nis.yaml. Not legal advice.
Get UK NIS / CS&R Bill changes in your inbox
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.