Desk live·
ForensicPost
Breaches/Regulation/File 25-1113

UK Publishes Draft Cyber Security and Resilience Bill

The UK published its draft Cyber Security and Resilience Bill on 12 November 2025, amending the NIS Regulations 2018 and representing the most significant reform of UK cyber legislation in years.

Constructed geometry · not a chart of case data
JurisdictionUnited Kingdomthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetUK regulated entities
ActorRegulator
D. Kennedy11 min readConfidence: high2 sources reviewed

The UK government published the draft Cyber Security and Resilience (Network and Information Systems) Bill on 12 November 2025, introducing it to Parliament and proposing substantial amendments to the Network and Information Systems Regulations 2018.

Seven Years Is A Long Time In This Database

The regime being amended was made in 2018. Almost nothing in this corpus existed in its current form then: ransomware-as-a-service at the scale recorded at 25-1226, the third-party concentration at 25-0801, service-desk social engineering at 25-0512, agent systems at 25-1009.

That gap is not a criticism of anyone. It is the structural problem with regulating this domain: primary legislation moves on a parliamentary timescale, and the thing it regulates does not.

What The Corpus Can Say About The Timing

The Bill arrived in the year of the retail campaign at 25-0501, the JLR production halt at 25-0902 and a state guarantee at 25-0928.

This desk is not asserting a causal link — legislation of this kind is years in preparation and the drafting predates those incidents. But a government that has just underwritten £1.5 billion of exposure arising from a single company’s intrusion is operating in a changed political environment, and the corpus should note the coincidence without inflating it.

A Draft Is Not A Law

The provisions described in the files that follow — 25-1119, 25-1121 and 25-1124 — are as introduced. Bills change in passage, and this desk records the proposal rather than a settled obligation.

How we reported this

This is a regulatory file built on published legal analysis of a draft Bill, listed below. Provisions are as introduced and may change. Corrections: corrections@forensicpost.com.

Sources
  1. Cyber Security and Resilience (network and information systems) Bill issued by UK governmentClifford Chance
  2. The UK Cyber Security and Resilience Bill and what it means for your businessGowling WLG
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary