The Cyber Security and Resilience Bill Is Nearly Law. Here's What It Means for Your Service Desk

The UK's biggest change to cyber security law since 2018 is one step from the finish. The Cyber Security and Resilience Bill completed its House of Lords stages on 2 November 2026. It now goes back to the Commons, which has to consider the changes the Lords made. After that comes Royal Assent.

It isn't law yet, and no date has been set for that last Commons step. But the shape is clear, and one part of it lands squarely on the service desk: a 24 hour clock for reporting serious incidents.

What the Bill does

It updates the Network and Information Systems Regulations 2018, the rules that already cover essential services such as energy, water, transport and health. The main change is who is covered. The Bill brings in:

Managed service providers. Medium and large providers come into scope for the first time. The government's own summary describes these as the firms that run IT helpdesks and cyber security services for other organisations. Their regulator will be the Information Commission.

Data centres. Medium and large data centres, and enterprise data centres above a set size.

Critical suppliers. Regulators will be able to designate the suppliers that essential and digital services depend on most.

Where the Bill is now

1. 12 Nov 2025
   Introduced in the House of Commons
   Done
2. 16 Jun 2026
   Passed the Commons
   Done
3. 2 Nov 2026
   Passed the Lords, with amendments
   Done
4. Date to be set
   Commons considers the Lords amendments
   Next
5. After that
   Royal Assent. The Bill becomes an Act
   To come

Illustration. Source: UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill, stages page, checked 12 November 2026.

The 24 hour clock

This is the part that changes how a service desk works. Under the government's plans, an organisation in scope that suffers a significant cyber incident will have to do three things.

Illustration. Source: GOV.UK, Cyber Security and Resilience Bill factsheet, Summary of the Bill.

The fine detail is still to come. The government has said the reporting rules will be set through secondary legislation, which follows the Act. So the timings are known, but exactly what counts as reportable is not yet final.

Why this is a service desk matter

A cyber incident rarely announces itself. It usually starts as a handful of ordinary tickets: a system running slowly, a login that won't work, a file that won't open. Somebody has to spot the pattern, call it a major incident and get the right people in the room.

Twenty four hours is not long to do that and send a notification. If the first few hours go on working out who owns the problem, or which customers sit behind the affected system, the deadline gets tight quickly.

The same goes for telling customers. You can only tell the right ones if your records show which customers rely on which services.

Where Halo helps

Halo doesn't make anyone compliant. No tool does. What it gives you is the place to run the process.

One console for major incidents. Halo has a Major Incident Console that shows every open major incident, its status, its priority, who it's assigned to and how long it has been open.

Clocks on the record. Each major incident shows when it was reported, with its response and resolution targets on screen. Halo can also send notifications as a ticket moves through its SLA.

Customers and communications in one place. A major incident record carries actions for impacted customers and for communications, plus business and technical tasks that can be assigned and tracked.

What the tool can't decide is your process: what counts as reportable, who makes the call, and who sends the notification. That part is design work.

Our read

Don't wait for Royal Assent to look at this. Three questions are worth asking now. Are you, or the providers you rely on, likely to be in scope? How long does it take your desk to get from the first odd ticket to a declared major incident? And if you had to tell affected customers today, could you produce the list?

If you'd like help with the second and third, Allied ESM can scope a review of your major incident process in Halo with you. Get in touch.

This article is a summary, not legal advice. For whether your organisation is in scope, speak to your legal adviser.