United Kingdom cybersecurity regime — and the NIS2 question for suppliers

The UK is not subject to NIS2 directly post-Brexit. The legal NIS-equivalent regime is the Network and Information Systems Regulations 2018, which applies to a narrower population than NIS2 — Operators of Essential Services (OES) in energy, transport, healthcare, water, and digital infrastructure, plus Relevant Digital Service Providers (RDSPs). The Cyber Security and Resilience Bill — through the Commons in June 2026 and in the House of Lords in October 2026, with the government expecting Royal Assent in 2027 — updates those 2018 Regulations to broadly align with, but not identically to, NIS2: managed service providers and data centres come into scope, and regulators gain a power to designate "critical suppliers" — direct suppliers to regulated operators whose disruption could have a significant impact. Most of it, those supplier duties included, commences by regulations after Royal Assent. The National Cyber Security Centre (NCSC) is the technical authority and CSIRT; the Information Commission (successor to the ICO since 30 September 2026) and sector regulators are competent authorities for RDSPs and OES respectively.

For most UK organisations outside the OES/RDSP scope, the practical cybersecurity baseline is Cyber Essentials and Cyber Essentials Plus — NCSC-backed certification schemes (administered by IASME) that cover the five core technical controls: firewalls, secure configuration, user access control, malware protection, and security update management. CE is required for many UK public-sector contracts and is increasingly the answer UK suppliers give when EU buyers ask for evidence of cybersecurity posture under their NIS2 supply-chain assessments. A UK supplier holding current CE Plus certification is a common, defensible — though not framework-equivalent — substitute for the NIS2 Article 21(2)(d) evidence an EU buyer is collecting.