The UK Cyber Security and Resilience Bill and NIS2: What UK and European Businesses Need to Know in 2026

If you run IT, security or compliance for a UK business, you have probably already heard about the Cyber Security and Resilience Bill and NIS2 in the same breath, usually followed by a sigh. Two overlapping regulatory frameworks, two sets of deadlines, and a threat landscape that is getting worse by the month. It is a lot to keep track of.

But 2026 is the year this stops being a "watch this space" issue and starts being a genuine business risk. Jaguar Land Rover's production line sat idle for roughly five weeks after last year's cyberattack, with the Cyber Monitoring Centre putting the total economic damage at around £1.9 billion, making it the costliest cyber incident in British history. Two members of the Scattered Spider group pleaded guilty this June to the 2024 attack that crippled Transport for London. The Legal Aid Agency exposed eighteen years of deeply sensitive applicant records, and HMRC lost £47 million to what was, by most accounts, a fairly ordinary phishing attack.

None of these were sophisticated nation-state operations exploiting unknown zero-days. Most were the sort of thing a proper penetration test, a well-run identity programme, or basic staff awareness training would have caught. That is exactly the point regulators across the UK and EU are trying to make with the current wave of legislation.

This article breaks down what NIS2 and the UK Cyber Security and Resilience Bill actually require, what is driving the current threat landscape, and what practical steps your organisation can take now rather than waiting for the Bill to receive Royal Assent.

Why 2026 Feels Different

Every year someone declares it "the worst year yet" for cybersecurity, and every year they turn out to be right. The UK's Cyber Security Breaches Survey for 2025/26 found that half of all UK businesses experienced some form of cyber incident in the past year, rising to 74% for medium sized firms and 91% for large organisations. The average cost of a UK data breach now sits at roughly £3.4 million, one of the highest figures anywhere in the world.

A few specific trends explain why this year has felt particularly brutal for security teams.

Identity has become the primary battleground. According to RSA's 2026 ID IQ Report, the share of organisations reporting identity related breaches jumped from 42% to 69% in a single year. Help desk social engineering, where attackers simply call IT support and talk their way into a password reset, has emerged as one of the fastest growing attack methods. It is low tech, it works, and it bypasses almost every technical control an organisation has spent years building.

Ransomware volume is climbing again. Global ransomware incidents rose around 33% year on year through the first half of 2026, with groups such as Qilin and The Gentlemen competing for the top spot in terms of victim count. Attacks against billion pound companies specifically jumped by around 74% quarter on quarter, a sign that larger, better resourced targets are no longer off limits.

Attackers are moving faster than defenders can patch. Microsoft's July 2026 Patch Tuesday addressed 570 flaws in a single release, including three actively exploited zero days. Meanwhile Akamai has recorded a 137% increase in attack traffic aimed specifically at APIs, which now sit at the centre of most modern digital services and often carry weaker authentication controls than the rest of the estate.

AI is doing the heavy lifting for attackers. The National Cyber Security Centre has repeatedly flagged that ransomware operators are now using automation and AI to scale phishing campaigns across thousands of targets at once, producing convincing, well written lures that no longer carry the spelling mistakes and awkward phrasing that used to be a giveaway.

Put those trends together and you get a threat landscape where the traditional advice of "train your staff and patch your systems" is still true, but nowhere near sufficient on its own.

NIS2: The EU Framework Already Reshaping Compliance

The NIS2 Directive came into force across the European Union in January 2023 and has been steadily rolling out across member states since. It replaces the original NIS Directive and dramatically widens the net, now covering eighteen sectors including energy, transport, banking, healthcare, digital infrastructure, and public administration.

If your business has EU customers, EU suppliers, or an EU subsidiary, NIS2 likely applies to you even if your head office sits in Manchester or Birmingham. The size thresholds generally catch medium and large enterprises, meaning 50 or more employees or annual turnover above €10 million, though member states can pull smaller organisations in critical sectors into scope as well.

Article 21 of the directive lays out ten minimum risk management measures that essential and important entities must have in place. These include:

• Risk analysis and information system security policies

• Incident handling procedures

• Business continuity and disaster recovery planning

• Supply chain security, including assessment of third party vendors

• Vulnerability handling and disclosure processes

• Policies to test and evaluate the effectiveness of security measures

• Basic cyber hygiene practices and staff training

• Policies on cryptography and encryption

• Access control and asset management

• Multi factor authentication and secure communications

None of these explicitly demand penetration testing by name, but in practice it is one of the most direct ways to demonstrate that your risk management measures actually hold up. An auditor can read a policy document. What they really want to see is evidence that someone tried to break in and recorded what happened.

Incident reporting is also far stricter under NIS2 than most UK businesses are used to. Organisations must submit an early warning within 24 hours of becoming aware of a significant incident, followed by a fuller notification within 72 hours. Penalties for essential entities can reach €10 million or 2% of global annual turnover, whichever is higher, which puts this firmly on the same scale as GDPR enforcement.

The UK Cyber Security and Resilience Bill: A British Answer to a European Problem

The UK's own response, the Cyber Security and Resilience Bill, was introduced in the House of Commons in November 2025 and has been working through Committee stage since. The government has been clear it wants the Bill to sit comfortably alongside NIS2, but this is not a straight copy and paste of the EU approach.

Some of the notable features of the Bill include:

• Expanded scope covering data centres, managed IT service providers, large electrical load controllers, and critical suppliers across the supply chain

• A two stage incident reporting process, with an initial notification within 24 hours and a full report within 72 hours, copied to the National Cyber Security Centre acting as the UK's CSIRT

• Wider reporting triggers that capture incidents even before any actual impact has occurred, provided a significant impact is judged likely

• New powers allowing regulators to recover costs associated with enforcement activity

• Fines of up to £17 million for the most serious breaches

Latest reporting from law firms following the Bill's progress suggests it is the most targeted country in Europe for cyberattacks, which goes some way to explaining the urgency behind it. The Bill is expected to receive Royal Assent later in 2026, though phased implementation means full enforcement may not land until 2028.

Here is the practical problem for UK businesses trading internationally. Because the UK Bill and NIS2 are similar in intent but different in detail, particularly around scope, secondary legislation, and reporting mechanics, many technology and infrastructure businesses will effectively need to satisfy two overlapping but distinct regimes at once. Waiting for the UK Bill to fully land before acting is not really an option if your organisation already sits inside NIS2's reach through European customers or suppliers.

What This Looks Like in Practice: Recent UK Incidents

Regulation can feel abstract until you look at what has actually gone wrong.

The Jaguar Land Rover attack, which began in August 2025, is now widely regarded as the most damaging cyber event in British corporate history. Beyond the roughly £196 million in direct company costs, the disruption rippled outward to more than 5,000 supply chain organisations, a stark illustration of exactly the supply chain risk that both NIS2 and the UK Bill are trying to force businesses to address.

The Legal Aid Agency breach exposed eighteen years of applicant data, including criminal histories and domestic abuse records, one of the most sensitive government data losses on record. Investigations into government breaches over recent years have repeatedly found that the root causes were antiquated systems and well understood, fixable technical weaknesses, not novel or unstoppable attack techniques.

Even HMRC, with all its resources, lost £47 million to a phishing attack that exploited basic human trust rather than a sophisticated technical flaw.

The common thread running through nearly all of these cases is that the failures were preventable. Proper penetration testing, enforced multi factor authentication, tested incident response plans, and genuine supply chain oversight would have closed most of these gaps before attackers ever found them.

A Practical Compliance Checklist

If you are trying to work out where to start, the following gives you a reasonable order of priorities for the rest of 2026.

1. Map your regulatory exposure. Work out whether NIS2, the UK Bill, GDPR, or sector specific rules such as those affecting financial services apply to your organisation, and where the overlaps and gaps sit.

2. Run a proper risk assessment. Not a tick box exercise, but a genuine review of your systems, data flows, and third party relationships against the ten Article 21 measures and equivalent UK requirements.

3. Commission manual penetration testing. Automated scanning catches the obvious issues. Manual, human led testing against your web applications, APIs, cloud environment, and network finds the exploitable gaps that automated tools routinely miss, and it produces the kind of evidence auditors actually want to see.

4. Tighten identity and access controls. Given that identity related breaches have overtaken almost every other attack vector, enforce multi factor authentication everywhere, apply least privilege access, and pay particular attention to how your help desk verifies identity before resetting credentials.

5. Test your incident response plan, not just document it. With 24 hour and 72 hour reporting windows now standard across both frameworks, your team needs to have actually rehearsed what happens in the first hour of a breach, not just have a policy sitting in a folder.

6. Assess your supply chain. Both regimes place real weight on third party and supplier risk. Ask your critical vendors for evidence of their own security posture, not just a signed contract clause.

7. Build in continuous monitoring. A single annual test gives you a snapshot. Given how fast the threat landscape moves, ongoing monitoring through SIEM or XDR tooling gives you a much better chance of catching an incident while it is still small.

How PlutoSec Can Help

This is exactly the ground PlutoSec works on every day for clients across the UK, including Manchester, London, Liverpool, Edinburgh, Glasgow, Birmingham, and Wales, alongside our teams in Canada and the US.

Our manual first penetration testing covers web, API, network, and cloud environments, mapped against OWASP, NIST, and PTES methodologies, so the findings translate directly into audit ready evidence for NIS2 or the UK Bill. Our compliance consulting team works through frameworks including SOC 2, PCI DSS, ISO 27001, and GDPR, helping you build a control set that satisfies multiple regulators at once rather than duplicating effort. Our identity and access management specialists focus specifically on the kind of help desk and credential based attacks that have become the leading cause of breaches this year, while our 24/7 monitoring and XDR services give you the visibility needed to catch incidents before they become headline news.

Regulation aside, the real reason to get this right is simple. The businesses that treated the Jaguar Land Rover, Legal Aid Agency, and HMRC incidents as warnings rather than headlines are the ones putting proper testing and identity controls in place now, before their name ends up on next year's breach list instead.

Final Thoughts

NIS2 and the UK Cyber Security and Resilience Bill are not just compliance paperwork. They are a direct response to a threat landscape that has genuinely changed, where identity is the new perimeter, AI is scaling attacks that used to require real skill, and a single missed patch can cascade through thousands of supply chain partners.

Whether the Bill lands with Royal Assent this year or drifts into 2027, the underlying advice does not change. Get a proper penetration test done. Lock down your identity controls. Rehearse your incident response. Look hard at your suppliers. The organisations doing this now will find compliance almost straightforward when the deadlines finally arrive. The ones waiting until the last minute will be scrambling, and in this threat environment, scrambling is an expensive way to learn a lesson.

If you want to know exactly where your organisation stands against NIS2 or the upcoming UK Bill, PlutoSec offers a free security assessment to help you find out.