Regulatory readiness for SMEs
Cyber regulation is tightening. Here's what it actually means for you.
There's a lot of noise about new cyber laws. Most of it does not apply directly to a typical small business, but some of it will reach you through your customers. This page explains the difference plainly, without the scaremongering.
Status correct as of 17 September 2026. Legislation is still moving, so check the official sources linked below for the current position.
The Cyber Security and Resilience Bill, in plain English
The Cyber Security and Resilience Bill is legislation working its way through Parliament that updates the UK's existing cyber rules, the Network and Information Systems (NIS) Regulations 2018. As of September 2026 it is in the House of Lords and has not yet become law. Royal Assent has been widely expected in late 2026, with some indications of spring 2027, and the detailed obligations are expected to take effect later still, around 2028, through follow-up regulations.
What it broadly does:
- Widens the rules to cover more organisations, including larger managed service providers, data centres and certain critical suppliers.
- Introduces faster incident reporting, including a 24-hour notification duty for significant incidents.
- Adds stronger enforcement, with penalties linked to turnover for regulated organisations.
Does it apply to my business?
For a typical business of 10 to 100 people, almost certainly not directly. The Bill is aimed at operators of essential services and larger technology providers, and the exact thresholds for who counts as a regulated managed service provider are still being decided in the follow-up regulations. A normal SME is not a regulated entity under this regime.
The honest version. You are unlikely to receive a letter from a regulator. What you are far more likely to see is your larger, regulated customers passing their own requirements down to you: security clauses in contracts, supplier security checks, and more detailed questionnaires before they'll sign. That is the mechanism that reaches ordinary SMEs, and it is already happening.
Where does the NCSC CAF fit in?
The Cyber Assessment Framework (CAF) is the NCSC's framework for assessing cyber resilience. It is designed primarily for organisations that run essential services or sit in regulated, high-impact sectors such as energy, healthcare, transport, digital infrastructure and government. A typical SME will not be assessed against the CAF directly.
It still matters to you for one practical reason: if one of your customers is a CAF-regulated organisation, their obligations flow down to their suppliers. When that customer asks how you manage security, we help you answer clearly and in proportion, without pretending you are something you are not.
So what should an SME actually do?
The good news is that the sensible response to all of this is the same thing you'd want to do anyway: get the fundamentals right and be able to prove it. That means:
- Cyber Essentials, so your core controls are certified and you have a straight answer for buyers and insurers.
- Well-managed IT: multi-factor authentication, patching, endpoint protection, backups and sensible Microsoft 365 configuration, kept in good order rather than set up once and forgotten.
- Someone accountable who can answer customer security questions with confidence, which is where a virtual CISO earns its place.
Do those three things and you are ready for the supply-chain pressure that this legislation creates, whether or not any of it ever names you directly.
This is general information, not legal advice. The law is changing and the detail is still being finalised. For the current position, see the official sources:
We're happy to talk through what, if anything, actually applies to your business.
Turn the noise into a short to-do list.
We'll tell you plainly where you stand and what's worth doing, in proportion to your business.