Cyber Security and Resilience Bill Advisory
The Cyber Security and Resilience Bill will extend the scope of the UK’s network and information systems framework to a significantly wider range of organisations. Higher education institutions, local authorities, and a range of public sector bodies currently outside the NIS Regulations are expected to come within scope. Incident reporting obligations, regulatory oversight, and the requirement to demonstrate effective cyber security governance will apply to organisations that have not previously faced that level of scrutiny.
The secondary legislation that determines the precise scope, the obligations in practice, and the enforcement timelines has not yet been laid. The Bill is still progressing through Parliament. But the direction is clear. Organisations that wait for the final text before taking any action will be the least prepared when it arrives.
Clark & Company is monitoring the Bill’s development and working with education and public sector organisations to assess their current position, identify what the new framework will require, and build the governance foundation now rather than under pressure later.
This service is available on enquiry. There is no rate card. The scope of work required varies by organisation — current maturity, regulatory exposure, sector, size, and governance structure all shape what preparation looks like. A conversation is the right starting point.
What the Advisory Covers
Bill tracking and impact assessment. Regular briefings on the Bill’s progress through Parliament and what the developing obligations mean in practice for your organisation, as legislation and regulatory guidance emerges. Sector-specific analysis, not general news monitoring.
Current position assessment. A structured review of your cyber security governance against the obligations the Bill is expected to impose, using the NIS Regulations and the Cyber Assessment Framework as the basis for that assessment.
Gap analysis. Identification of the specific gaps between your current position and what the Bill is likely to require, with a clear view on what needs to change and in what order.
Governance framework development. Where your organisation needs to build or strengthen the governance arrangements the Bill will require — risk management processes, incident response and reporting capability, board-level oversight — Clark & Company can support that as a structured engagement.
Board and senior leadership briefing. The Bill creates governance obligations at board level, not just IT obligations. Governing bodies and senior leadership teams need to understand what is coming and what they will be accountable for.
Regulatory readiness. When the Bill comes into force, your organisation will need to demonstrate to a regulator that cyber security is being managed effectively. Preparation now builds the documentation and governance record that makes that possible.
Who This Is For
This advisory is most relevant to higher education institutions and local authorities that are not currently subject to the NIS Regulations but are expected to come within scope under the Bill. It is also relevant to organisations already within NIS scope that need to prepare for the extended obligations the Bill will introduce.
It is equally relevant to governing bodies and senior leadership teams who need to understand what is coming before it becomes a regulatory requirement rather than a governance choice.